https://vulnogram.org/ Most recent CVEs assigned by Acer Inc. (acer). https://vulnogram.org/seaview/icons/acer.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-50228 https://vulnogram.org/CVE-2026-50228 An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production appli… Medium Wed, 23 Sep 2026 07:20:41 GMT https://vulnogram.org/CVE-2026-50227 https://vulnogram.org/CVE-2026-50227 An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_p… Medium Wed, 23 Sep 2026 07:15:36 GMT https://vulnogram.org/CVE-2026-50610 https://vulnogram.org/CVE-2026-50610 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perf… High Thu, 17 Sep 2026 08:26:21 GMT https://vulnogram.org/CVE-2026-50609 https://vulnogram.org/CVE-2026-50609 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized… High Thu, 17 Sep 2026 08:21:29 GMT https://vulnogram.org/CVE-2026-50608 https://vulnogram.org/CVE-2026-50608 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain… Low Thu, 17 Sep 2026 08:15:17 GMT https://vulnogram.org/CVE-2026-50607 https://vulnogram.org/CVE-2026-50607 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access. Low Network Exploitable Thu, 17 Sep 2026 08:05:44 GMT https://vulnogram.org/CVE-2026-50606 https://vulnogram.org/CVE-2026-50606 A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a loca… Low Thu, 17 Sep 2026 07:59:52 GMT https://vulnogram.org/CVE-2026-50605 https://vulnogram.org/CVE-2026-50605 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operat… High Thu, 17 Sep 2026 07:53:44 GMT https://vulnogram.org/CVE-2026-50604 https://vulnogram.org/CVE-2026-50604 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstanc… Medium Thu, 17 Sep 2026 04:06:40 GMT https://vulnogram.org/CVE-2026-50603 https://vulnogram.org/CVE-2026-50603 A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local at… Medium Thu, 17 Sep 2026 04:01:12 GMT https://vulnogram.org/CVE-2026-50602 https://vulnogram.org/CVE-2026-50602 A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants exce… High Mon, 17 Aug 2026 02:16:49 GMT https://vulnogram.org/CVE-2026-50601 https://vulnogram.org/CVE-2026-50601 A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys… Medium Network Exploitable Mon, 17 Aug 2026 02:02:40 GMT https://vulnogram.org/CVE-2026-50226 https://vulnogram.org/CVE-2026-50226 Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links. Medium Network Exploitable Thu, 04 Jun 2026 09:34:34 GMT https://vulnogram.org/CVE-2026-50225 https://vulnogram.org/CVE-2026-50225 The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database. High Network Exploitable Thu, 04 Jun 2026 09:29:57 GMT https://vulnogram.org/CVE-2026-50224 https://vulnogram.org/CVE-2026-50224 The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN. Medium Thu, 04 Jun 2026 09:26:00 GMT https://vulnogram.org/CVE-2026-50214 https://vulnogram.org/CVE-2026-50214 The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans. Critical Network Exploitable Thu, 04 Jun 2026 09:20:37 GMT https://vulnogram.org/CVE-2026-50213 https://vulnogram.org/CVE-2026-50213 The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings. High Network Exploitable Thu, 04 Jun 2026 07:39:21 GMT https://vulnogram.org/CVE-2026-50212 https://vulnogram.org/CVE-2026-50212 Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service. High Thu, 04 Jun 2026 07:32:55 GMT https://vulnogram.org/CVE-2026-50211 https://vulnogram.org/CVE-2026-50211 Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers. High Network Exploitable Thu, 04 Jun 2026 07:28:12 GMT https://vulnogram.org/CVE-2026-50210 https://vulnogram.org/CVE-2026-50210 The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption. Medium Network Exploitable Thu, 04 Jun 2026 07:22:44 GMT https://vulnogram.org/CVE-2026-50209 https://vulnogram.org/CVE-2026-50209 Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker. Critical Thu, 04 Jun 2026 07:17:54 GMT https://vulnogram.org/CVE-2026-50208 https://vulnogram.org/CVE-2026-50208 High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic. Critical Network Exploitable Thu, 04 Jun 2026 07:09:45 GMT https://vulnogram.org/CVE-2026-50207 https://vulnogram.org/CVE-2026-50207 The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity. High Thu, 04 Jun 2026 07:04:50 GMT https://vulnogram.org/CVE-2026-50206 https://vulnogram.org/CVE-2026-50206 Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files. High Thu, 04 Jun 2026 06:46:48 GMT https://vulnogram.org/CVE-2026-50205 https://vulnogram.org/CVE-2026-50205 System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data. High Network Exploitable Thu, 04 Jun 2026 06:43:00 GMT https://vulnogram.org/CVE-2026-49204 https://vulnogram.org/CVE-2026-49204 Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation. Medium Network Exploitable Thu, 04 Jun 2026 06:35:18 GMT https://vulnogram.org/CVE-2026-49202 https://vulnogram.org/CVE-2026-49202 Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft. High Network Exploitable Thu, 04 Jun 2026 06:30:57 GMT https://vulnogram.org/CVE-2026-49203 https://vulnogram.org/CVE-2026-49203 Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted. High Thu, 04 Jun 2026 06:25:22 GMT https://vulnogram.org/CVE-2026-49194 https://vulnogram.org/CVE-2026-49194 The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface. Critical Thu, 04 Jun 2026 06:21:01 GMT https://vulnogram.org/CVE-2026-49193 https://vulnogram.org/CVE-2026-49193 Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet. High Network Exploitable Thu, 04 Jun 2026 06:17:07 GMT https://vulnogram.org/CVE-2026-49192 https://vulnogram.org/CVE-2026-49192 The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping. Medium Thu, 04 Jun 2026 05:43:55 GMT https://vulnogram.org/CVE-2026-49191 https://vulnogram.org/CVE-2026-49191 The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages. Critical Network Exploitable Thu, 04 Jun 2026 05:36:09 GMT https://vulnogram.org/CVE-2026-49190 https://vulnogram.org/CVE-2026-49190 The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions. Critical Thu, 04 Jun 2026 05:28:48 GMT https://vulnogram.org/CVE-2026-49189 https://vulnogram.org/CVE-2026-49189 Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations. High Thu, 04 Jun 2026 05:23:10 GMT https://vulnogram.org/CVE-2026-49188 https://vulnogram.org/CVE-2026-49188 The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands. High Thu, 04 Jun 2026 04:08:08 GMT https://vulnogram.org/CVE-2026-49187 https://vulnogram.org/CVE-2026-49187 The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse. High Network Exploitable Thu, 04 Jun 2026 03:50:11 GMT https://vulnogram.org/CVE-2026-49186 https://vulnogram.org/CVE-2026-49186 The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands. High Thu, 04 Jun 2026 03:36:59 GMT https://vulnogram.org/CVE-2026-49185 https://vulnogram.org/CVE-2026-49185 The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection. Critical Network Exploitable Thu, 04 Jun 2026 02:55:48 GMT https://vulnogram.org/CVE-2026-49201 https://vulnogram.org/CVE-2026-49201 The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection. Critical Network Exploitable Fri, 29 May 2026 08:57:54 GMT https://vulnogram.org/CVE-2026-49200 https://vulnogram.org/CVE-2026-49200 The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access. Critical Network Exploitable Fri, 29 May 2026 08:51:15 GMT https://vulnogram.org/CVE-2026-49199 https://vulnogram.org/CVE-2026-49199 Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device. Critical Network Exploitable Fri, 29 May 2026 08:38:24 GMT https://vulnogram.org/CVE-2026-49198 https://vulnogram.org/CVE-2026-49198 Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors. High Fri, 29 May 2026 08:30:28 GMT https://vulnogram.org/CVE-2026-49197 https://vulnogram.org/CVE-2026-49197 Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails. Critical Network Exploitable Fri, 29 May 2026 08:24:06 GMT https://vulnogram.org/CVE-2026-49196 https://vulnogram.org/CVE-2026-49196 The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands. High Fri, 29 May 2026 08:15:49 GMT https://vulnogram.org/CVE-2026-49195 https://vulnogram.org/CVE-2026-49195 Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands. High Fri, 29 May 2026 08:02:48 GMT https://vulnogram.org/CVE-2026-9789 https://vulnogram.org/CVE-2026-9789 A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows an… High Thu, 28 May 2026 02:39:40 GMT https://vulnogram.org/CVE-2026-9490 https://vulnogram.org/CVE-2026-9490 A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (mes… Medium Mon, 25 May 2026 07:25:02 GMT https://vulnogram.org/CVE-2026-9489 https://vulnogram.org/CVE-2026-9489 NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authent… High Mon, 25 May 2026 01:50:32 GMT https://vulnogram.org/CVE-2026-8069 https://vulnogram.org/CVE-2026-8069 PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing… High Fri, 08 May 2026 05:57:22 GMT