CVE-2026-50227 — MQTT WebSocket Command Execution Vulnerability in NitroSense

CVE-2026-50227

MQTT WebSocket Command Execution Vulnerability in NitroSense PUBLISHED

Description (CNA)

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

Affected (CNA)

Vendor / product	Versions
Acer / NitroSense V5	affected * through 5.2.62

CWE

CWE-306, CWE-78

References

https://community.acer.com/en/kb/articles/20052

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.