CVE-2026-50228

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50228", "assignerOrgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "state": "PUBLISHED", "assignerShortName": "Acer", "dateReserved": "2026-06-04T09:22:14.582Z", "datePublished": "2026-09-23T07:20:41.257Z", "dateUpdated": "2026-09-23T14:49:44.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "shortName": "Acer", "dateUpdated": "2026-09-23T07:20:41.257Z"}, "title": "Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-489", "description": "CWE-489 Active debug code", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-121", "descriptions": [{"lang": "en", "value": "CAPEC-121 Exploit Non-Production Interfaces"}]}], "affected": [{"vendor": "Acer", "product": "NitroSense V5", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "*", "lessThanOrEqual": "5.2.63", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution."}]}], "references": [{"url": "https://community.acer.com/en/kb/articles/20051"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"}}], "solutions": [{"lang": "en", "value": "Update NitroSense to version 5.2.84 or\nlater to fix.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Update NitroSense to version 5.2.84 or\nlater to fix.</p>"}]}], "credits": [{"lang": "en", "value": "Tolga C\u00f6hce", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T14:49:30.806462Z", "id": "CVE-2026-50228", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T14:49:44.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50228", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T14:49:30.806462Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T14:49:41.153Z"}}], "cna": {"title": "Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Tolga C\u00f6hce"}], "impacts": [{"capecId": "CAPEC-121", "descriptions": [{"lang": "en", "value": "CAPEC-121 Exploit Non-Production Interfaces"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Acer", "product": "NitroSense V5", "versions": [{"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "5.2.63"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update NitroSense to version 5.2.84 or\nlater to fix.", "supportingMedia": [{"type": "text/html", "value": "<p>Update NitroSense to version 5.2.84 or\nlater to fix.</p>", "base64": false}]}], "references": [{"url": "https://community.acer.com/en/kb/articles/20051"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-489", "description": "CWE-489 Active debug code"}]}], "providerMetadata": {"orgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "shortName": "Acer", "dateUpdated": "2026-09-23T07:20:41.257Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50228", "state": "PUBLISHED", "dateUpdated": "2026-09-23T14:49:44.663Z", "dateReserved": "2026-06-04T09:22:14.582Z", "assignerOrgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "datePublished": "2026-09-23T07:20:41.257Z", "assignerShortName": "Acer"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "NitroSense V5", "vendor": "Acer", "versions": [{"lessThanOrEqual": "5.2.63", "status": "affected", "version": "*", "versionType": "custom"}]}], "source": "8fc372e3-d9c5-46e4-9410-38469745c639"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution."}], "id": "CVE-2026-50228", "lastModified": "2026-09-25T13:15:28.037", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50228", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T14:49:30.806462Z", "version": "2.0.3"}}]}, "published": "2026-09-23T08:17:10.493", "references": [{"source": "8fc372e3-d9c5-46e4-9410-38469745c639", "url": "https://community.acer.com/en/kb/articles/20051"}], "sourceIdentifier": "8fc372e3-d9c5-46e4-9410-38469745c639", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-489"}], "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["Windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.2.63]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "nitrosense_v5", "vendor": "acer"}], "created": "2026-09-23T14:00:05.013846+00:00", "updated": "2026-09-24T09:14:43.499084+00:00", "vendors": ["acer", "acer$PRODUCT$nitrosense_v5"]}