Vendor
Acer
58 known vulnerabilities.
Products
12 results · Clear filters · Feed
-
Medium 6.1
Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, t…
-
Medium 6.1
MQTT WebSocket Command Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.ex…
-
Medium 4.9
Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an un…
-
Medium 4.9
Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker ma…
-
Medium 6.6
Planet9 Hardcoded Credentials Vulnerability Information
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secre…
-
Medium 6.9
Firmware Theft & IMEI Spoofing via Connect-OTA
Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.
-
Medium 6.9
Unauthenticated IPv6 WAN Management Exposure
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.
-
Medium 6.9
Weak Static Cryptographic Initialization Vectors
The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.
-
Medium 6.9
Hard-coded AWS Cognito Testing Accounts
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
-
Medium 5.3
Summary Service Insecure Direct Object Reference
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.
-
Medium 6.8CVE-2026-9490 Public exploit
Acer Care Center creates a Named Pipe with a weak Security Descriptor
A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type…
-
Medium 6.4
Insecure Platform Key (PK) used in UEFI system firmware signature
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affe…