Description
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.
Published: 2026-09-23
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Update NitroSense to version 5.2.84 or later to fix.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.
Title Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
Weaknesses CWE-489
References
Metrics cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Acer

Published:

Updated: 2026-09-23T07:20:41.257Z

Reserved: 2026-06-04T09:22:14.582Z

Link: CVE-2026-50228

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T08:17:10.493

Modified: 2026-09-23T08:17:10.493

Link: CVE-2026-50228

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses