An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). The attack allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), which results in arbitrary command execution in the application context. This vulnerability arises from an authentication bypass and allows the attacker to inject operating‑system commands through the MQTT interface.

The affected system is Acer NitroSense V5. Versions up to 5.2.62 are vulnerable; any installed instance of NitroSense on a local machine that has the MQTT WebSocket endpoint enabled may be compromised. Updating to NitroSense 5.2.84 or later removes this flaw.

The CVSS score of 6.1 indicates a moderate severity level. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting limited widespread exploitation data. However, the vulnerability requires local access and has no authentication constraints, meaning any local user or compromised process can launch arbitrary commands via the WebSocket interface.