{"id":"CVE-2026-50228","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-50228","generatedAt":"2026-10-28T09:27:27.499Z","title":"An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993.","description":"An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.","published":"2026-09-23T08:17:10.000Z","lastModified":"2026-09-25T13:15:28.000Z","status":"Deferred","sourceIdentifier":"8fc372e3-d9c5-46e4-9410-38469745c639","cvss":{"version":"4.0","score":6.1,"severity":"MEDIUM","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-489"],"affected":[],"epss":{"score":0.00179,"percentile":0.0741,"date":"2026-10-27","history":[{"date":"2026-09-23","score":0.00179,"percentile":0.07689}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-23T08:17:10.000Z","detail":{"score":"6.1","severity":"MEDIUM","publishedAt":"2026-09-23T08:17:10.493Z"},"summary":"New CVE, medium severity (CVSS 6.1)."}],"references":[{"url":"https://community.acer.com/en/kb/articles/20051","source":"8fc372e3-d9c5-46e4-9410-38469745c639"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-50228","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}