Acer

Latest CVEs · RSS

• CVE-2026-50228 2026-09-23 · CVSS 6.1
  An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on loc
• CVE-2026-50227 2026-09-23 · CVSS 6.1
  An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including
• CVE-2026-50610 2026-09-17 · CVSS 7.4
  A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a
• CVE-2026-50609 2026-09-17 · CVSS 7.4
  A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a pr
• CVE-2026-50608 2026-09-17 · CVSS 1.2
  A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not
• CVE-2026-50607 2026-09-17 · CVSS 2.7
  A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to li
• CVE-2026-50606 2026-09-17 · CVSS 1.2
  A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use o
• CVE-2026-50605 2026-09-17 · CVSS 7.4
  A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privil
• CVE-2026-50604 2026-09-17 · CVSS 4.9
  A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not proper
• CVE-2026-50603 2026-09-17 · CVSS 4.9
  A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a
• CVE-2026-50602 2026-08-17 · CVSS 8.5
  A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background s
• CVE-2026-50601 2026-08-17 · CVSS 6.6
  A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal re
• CVE-2026-50226 2026-06-04 · CVSS 6.9
  Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized
• CVE-2026-50225 2026-06-04 · CVSS 8.8
  The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.
• CVE-2026-50224 2026-06-04 · CVSS 6.9
  The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints rea
• CVE-2026-50214 2026-06-04 · CVSS 9.3
  The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access pl
• CVE-2026-50213 2026-06-04 · CVSS 8.7
  The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification s
• CVE-2026-50212 2026-06-04 · CVSS 7.1
  Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of ser
• CVE-2026-50211 2026-06-04 · CVSS 8.8
  Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM
• CVE-2026-50210 2026-06-04 · CVSS 6.9
  The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decrypt
• CVE-2026-50209 2026-06-04 · CVSS 9.3
  Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to
• CVE-2026-50208 2026-06-04 · CVSS 9.2
  High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM)
• CVE-2026-50207 2026-06-04 · CVSS 8.5
  The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectiv
• CVE-2026-50206 2026-06-04 · CVSS 8.5
  Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.
• CVE-2026-50205 2026-06-04 · CVSS 8.8
  System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.