CVE-2026-50227: MQTT WebSocket Command Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync(), resulting in arbitrary command execution in the application context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Acer NitroSenseto a version that resolves this vulnerability.Fixed in 5.2.84
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have local access to the affected system and be able to connect to the MQTT broker's localhost WebSocket endpoint. The described attack does not require authentication.
What access does successful exploitation provide?
The attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), to execute arbitrary commands in the NitroSense application context.
Which NitroSense versions are affected?
Acer NitroSense versions up to and including 5.2.62 are affected.