EUVD-2026-60025
GHSA-5gvf-3qfc-gwmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible hardcoded key requires no authentication; scope changes to internal repositories where embedded admin credential confidentiality is breached.
Primary rating from Vendor (Acer).
CVSS VectorVendor: Acer
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access to repository infrastructure and modify software source code. To mitigate this security risk, Acer has released an update to resolve the issue.
AnalysisAI
The Acer Planet9 desktop application contains a hardcoded read-only API key that grants unauthenticated network access to Acer's internal repositories. Any user possessing the application binary can extract this credential via static analysis, access repository contents, and recover embedded administrative credentials from within those repositories - potentially enabling administrative control over repository infrastructure and software source code modification. No public exploit code exists at time of analysis (CVSS 4.0 E:U), and Acer has released an update to remediate the issue.
Technical ContextAI
Planet9 is Acer's gaming software and community desktop platform. CWE-798 (Use of Hard-coded Credentials) describes static credentials compiled directly into application binaries or configuration files, which are trivially recoverable through reverse-engineering tools such as strings extraction, disassembly, or decompilation - no specialized knowledge is required. The affected CPE cpe:2.3:a:acer:planet9_desktop_application:*:*:*:*:*:*:*:* uses a wildcard version field, indicating no specific unaffected version is confirmed and all analyzed releases are considered vulnerable. The attack exploits a two-stage credential chain: the hardcoded read-only API key grants repository read access, and those repositories contain higher-privileged administrative credentials that further escalate attack impact well beyond the initial confidentiality breach.
RemediationAI
Apply the update released by Acer as documented at https://community.acer.com/en/kb/articles/19869; the exact patched version number is not independently confirmed from available data, so verify the target version directly against the advisory before deployment. As a compensating control prior to patching, restrict outbound network access from the Planet9 application to prevent the hardcoded API key from being used to authenticate to Acer's internal repository endpoints - note that this may degrade Planet9 functionality that depends on external connectivity. Organizations with managed endpoints should audit whether the application is deployed beyond gaming and consumer use cases given the repository access scope of the exposure.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today