An unauthenticated local attacker can connect to the Electron DevTools endpoint that Acer NitroSense exposes on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can run JavaScript in the privileged application context and achieve arbitrary code execution. This is a moderate‑sensitivity flaw classified as CWE‑489.

The vulnerability affects Acer NitroSense V5, specifically all builds up to version 5.2.63. Users running any of these affected releases are at risk until an update is applied.

The CVSS score of 6.1 reflects moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Since the attack can be launched from any local user account without authentication, the risk is that a local attacker can execute arbitrary code with the rights of the NitroSense process. The attack vector is local, leveraging an unprotected debugging interface exposed on a loopback address.