EUVD-2026-85151
GHSA-x445-jgfc-928v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local foothold on Acer laptop
-
ExploitConnect to localhost MQTT WebSocket (no auth)
-
ExecutionInvoke ddsc execSync RPC function
-
ImpactExecute arbitrary commands in NitroSense context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a local foothold on an Acer laptop with NitroSense (up to and including 5.2.62) installed and running, and (2) the NitroSense MQTT broker exposing its localhost WebSocket endpoint with no authentication. Because the endpoint binds to localhost, exploitation is LIMITED to attackers/processes already executing on the same machine - there is no network attack surface. No user interaction and no credentials are needed once local access exists; any local process can invoke the ddsc RPC functions. |
| Impact | This is a genuine code-execution flaw but with a self-limiting attack surface. The CVSS 4.0 vector (AV:L) confirms the attack is LOCAL, not network - the MQTT broker is only exposed on a localhost WebSocket endpoint, so an attacker must already have a foothold (any local user or process) on the machine. Given that, PR:N is meaningful: no authentication is enforced on the broker (CWE-306), so ANY local process can invoke the ddsc RPC functions and reach child_process.execSync() for arbitrary command execution. Technical impact is full (VC:H/VI:H/VA:H). Threat signals de-escalate the priority: the vendor-supplied vector carries E:U (exploit maturity Unreported), there is no POC, no EPSS score, and no CISA KEV listing - so this is 'no public exploit identified at time of analysis.' The vendor 4.0 base metrics are high (~8.4) and are pulled down to 6.1 only by the E:U threat modifier; the CVSS-3.1 equivalent of the base is ~7.8. Net: a real local privilege/lateral-execution primitive worth patching on Acer gaming laptops, but not a remote or wormable priority. Note the localhost-only exposure sharply constrains real-world risk versus the raw impact metrics. |
| Exploit ScenarioDerived | A low-privileged process or user already present on an Acer laptop running NitroSense (e.g. from a phishing payload or a compromised low-integrity app) opens a WebSocket connection to the local MQTT broker, which requires no authentication. It publishes a message invoking the exposed ddsc RPC child_process.execSync() function to run arbitrary OS commands in NitroSense's process context, potentially escalating privileges if NitroSense runs elevated. No public exploit code is currently known (E:U). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.
RemediationAI
Vendor patch status is not confirmed in the available data - no fixed version number is stated, and version 5.2.62 is the last known-affected release, so the first action is to check Acer's advisory at https://community.acer.com/en/kb/articles/20052 and, if a build later than 5.2.62 exists, update NitroSense to it through the official installer or Acer's support channel and confirm the running version afterwards. If no patched build is yet available, apply targeted compensating controls rather than generic advice: stop or disable the NitroSense MQTT broker/WebSocket service when the utility is not in active use (trade-off: RGB, fan-curve, performance-mode and macro features served through that IPC channel will stop working), bind the WebSocket listener to an authenticated or OS-ACL-protected local socket if the deployment allows configuration changes (trade-off: requires editing the broker configuration and may be reverted by a NitroSense update), and run NitroSense as a standard, non-administrative user so that any command execution it enables is contained to that user's token instead of SYSTEM/administrator privileges (trade-off: some hardware-control features may demand elevation and fail). Because the endpoint is localhost-only, network firewalling does not remove the attack surface; instead, monitor and alert on unexpected local processes opening WebSocket connections to the NitroSense broker port and on NitroSense spawning shells or scripting interpreters, and restrict which users and processes are permitted to execute on machines where the utility is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NitroSense is Acer's Windows gaming-utility suite for Nitro laptops, and it runs an internal MQTT broker to support IPC between its components and UI. That broker exposes a WebSocket listener bound to localhost, and the listener performs no authentication or authorization on connecting clients - the root cause class is CWE-306 (Missing Authentication for Critical Function). Once connected, a client can call exposed ddsc RPC methods, one of which reaches Node.js-style child_process.execSync(), translating an unauthenticated local IPC request into arbitrary command execution inside the NitroSense process context. The CPE cpe:2.3:a:acer:nitrosense_v5:*:*:*:*:*:*:*:* with a wildcard version confirms the identifier covers the entire NitroSense v5 line through 5.2.62. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U) marks the attack as local, low complexity, no privileges, no user interaction, with high confidentiality/integrity/availability impact confined to the vulnerable system and no reported exploit maturity.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Localhost-only WebSocket forces AV:L; unauthenticated broker means PR:N; arbitrary command execution in app context yields full C/I/A:H with no scope change.
Primary rating from Vendor (Acer).
CVSS VectorVendor: Acer
DescriptionCVE.org
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB