Nitrosense V5
Monthly
Local code execution in Acer NitroSense v5 (versions up to and including 5.2.63) allows an attacker who already has shell access on the host to run arbitrary code in the privileged context of the application by connecting to an Electron/Chromium DevTools endpoint left enabled in the production build and bound to localhost TCP port 9993. No authentication or user interaction is required against that debug port, and the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity and availability impact once local access exists, but the exposure is confined to loopback and is therefore not remotely reachable. No public exploit code was identified and there is no CISA KEV listing at time of analysis; this is a moderate, locally-scoped risk rather than a remote emergency, and its main value to an attacker is as a privilege-escalation or persistence primitive on an already-compromised endpoint.
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.
Local code execution in Acer NitroSense v5 (versions up to and including 5.2.63) allows an attacker who already has shell access on the host to run arbitrary code in the privileged context of the application by connecting to an Electron/Chromium DevTools endpoint left enabled in the production build and bound to localhost TCP port 9993. No authentication or user interaction is required against that debug port, and the assessed CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity and availability impact once local access exists, but the exposure is confined to loopback and is therefore not remotely reachable. No public exploit code was identified and there is no CISA KEV listing at time of analysis; this is a moderate, locally-scoped risk rather than a remote emergency, and its main value to an attacker is as a privilege-escalation or persistence primitive on an already-compromised endpoint.
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.