Acer
Vulnerability activity for Acer: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 10
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 46
- Critical (CVSS 9+)
- 12
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.1MediumSep 23, 2026Acer NitroSense V5CVE-2026-50228An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.
- 6.1MediumSep 23, 2026Acer NitroSense V5 Code / command injectionCVE-2026-50227An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.
- 7.4HighSep 17, 2026Acer System Monitoring Auth bypass / access controlCVE-2026-50610A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications, potentially resulting in local privilege escalation.
- 7.4HighSep 17, 2026Acer System Monitoring Auth bypass / access controlCVE-2026-50609A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.
- 1.2LowSep 17, 2026Acer System Monitoring Auth bypass / access controlCVE-2026-50608A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.
- 2.7LowSep 17, 2026Acer System Monitoring Information disclosureCVE-2026-50607A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access.
- 1.2LowSep 17, 2026Acer System Monitoring Crypto / certificateCVE-2026-50606A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.
- 7.4HighSep 17, 2026Acer Agent Serivce Auth bypass / access controlCVE-2026-50605A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.
- 4.9MediumSep 17, 2026Acer Agent Service Auth bypass / access controlCVE-2026-50604A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.
- 4.9MediumSep 17, 2026Acer Agent Service Crypto / certificateCVE-2026-50603A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.
- 5.3MediumJun 4, 2026Acer connect m6e 5g firmware Crypto / certificateCVE-2026-50226Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.
- 9.1CriticalJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-50225The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.
- 4.9MediumJun 4, 2026Acer connect m6e 5g firmware Information disclosureCVE-2026-50224The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.
- 9.8CriticalJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-50214The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
- 7.5HighJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-50213The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.
- 6.5MediumJun 4, 2026Acer connect m6e 5g firmware Denial of serviceCVE-2026-50212Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.
- 9.8CriticalJun 4, 2026Acer connect m6e 5g firmwareCVE-2026-50211Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.
- 7.5HighJun 4, 2026Acer connect m6e 5g firmware Information disclosureCVE-2026-50210The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.
- 7.8HighJun 4, 2026Acer connect m6e 5g firmware Privilege escalationCVE-2026-50209Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.
- 9.4CriticalJun 4, 2026Acer connect m6e 5g firmware Crypto / certificateCVE-2026-50208High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
- 7.8HighJun 4, 2026Acer connect m6e 5g firmware Path traversal / file handlingCVE-2026-50207The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.
- 6.8MediumJun 4, 2026Acer connect m6e 5g firmware Code / command injectionCVE-2026-50206Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.
- 8.2HighJun 4, 2026Acer connect m6e 5g firmware Information disclosureCVE-2026-50205System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
- 6.5MediumJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49204Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
- 8.3HighJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49203Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.
- 8.6HighJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49202Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.
- 8.8HighJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49194The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.
- 7.5HighJun 4, 2026Acer connect m6e 5g firmware Information disclosureCVE-2026-49193Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.
- 5.4MediumJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49192The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.
- 9.8CriticalJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49191The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.
- 8.8HighJun 4, 2026Acer connect m6e 5g firmware Code / command injectionCVE-2026-49190The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.
- 7.8HighJun 4, 2026Acer connect m6e 5g firmware Privilege escalationCVE-2026-49189Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
- 9.8CriticalJun 4, 2026Acer connect m6e 5g firmwareCVE-2026-49188The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
- 7.5HighJun 4, 2026Acer connect m6e 5g firmware Information disclosureCVE-2026-49187The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.
- 9.8CriticalJun 4, 2026Acer connect m6e 5g firmware Auth bypass / access controlCVE-2026-49186The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.
- 9.8CriticalJun 4, 2026Acer connect m6e 5g firmware Code / command injectionCVE-2026-49185The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.
- 9.8CriticalMay 29, 2026Acer wave 7 firmware Auth bypass / access controlCVE-2026-49201The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
- 9.8CriticalMay 29, 2026Acer wave 7 firmware Information disclosureCVE-2026-49200The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
- 9.8CriticalMay 29, 2026Acer predator connect w6x firmware Code / command injectionCVE-2026-49199Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.
- 4.9MediumMay 29, 2026Acer predator connect w6x firmware Auth bypass / access controlCVE-2026-49198Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.
- 9.8CriticalMay 29, 2026Acer predator connect w6x firmware Auth bypass / access controlCVE-2026-49197Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
- 7.2HighMay 29, 2026Acer predator connect w6x firmware Code / command injectionCVE-2026-49196The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.
- 8.8HighMay 29, 2026Acer predator connect w6x firmware Auth bypass / access controlCVE-2026-49195Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.
- 8.5HighMay 28, 2026Acer NitrorSense V3 Path traversal / file handlingCVE-2026-9789A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.
- 5.5MediumMay 25, 2026Acer care center Privilege escalationCVE-2026-9490A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.
- 7.8HighMay 8, 2026Acer nitrosense Path traversal / file handlingCVE-2026-8069PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges
Top products
- connect m6e 5g firmware26 CVEs in the last year, 8 critical
- System Monitoring5 CVEs in the last year
- predator connect w6x firmware5 CVEs in the last year, 2 critical
- wave 7 firmware2 CVEs in the last year, 2 critical
- NitroSense V52 CVEs in the last year
- Agent Service2 CVEs in the last year
- nitrosense1 CVE in the last year
- NitrorSense V31 CVE in the last year
- care center1 CVE in the last year
- Agent Serivce1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.