Planet9 Desktop Application
Monthly
The Acer Planet9 desktop application contains a hardcoded read-only API key that grants unauthenticated network access to Acer's internal repositories. Any user possessing the application binary can extract this credential via static analysis, access repository contents, and recover embedded administrative credentials from within those repositories - potentially enabling administrative control over repository infrastructure and software source code modification. No public exploit code exists at time of analysis (CVSS 4.0 E:U), and Acer has released an update to remediate the issue.
The Acer Planet9 desktop application contains a hardcoded read-only API key that grants unauthenticated network access to Acer's internal repositories. Any user possessing the application binary can extract this credential via static analysis, access repository contents, and recover embedded administrative credentials from within those repositories - potentially enabling administrative control over repository infrastructure and software source code modification. No public exploit code exists at time of analysis (CVSS 4.0 E:U), and Acer has released an update to remediate the issue.