A critical vulnerability in Acer NitroSense V5 allows unauthenticated local attackers to achieve arbitrary code execution by exploiting an exposed Electron DevTools debugging endpoint.

The software inadvertently leaves Chromium remote debugging enabled in production builds, exposing an Electron DevTools endpoint on localhost TCP port 9993. This allows an unauthenticated local user to inject and execute arbitrary JavaScript within the privileged application context.

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the NitroSense application. This could lead to a full compromise of the local system, unauthorized access to sensitive hardware controls, and potential persistence mechanisms established by the attacker. While the CVSS score is 6.1, the ability to achieve arbitrary code execution via a simple local network connection presents a significant risk to workstation integrity.

Immediate Action: Update Acer NitroSense V5 to version 5.2.84 or later to disable the vulnerable debugging endpoint.

Proactive Monitoring: Monitor local system logs for unauthorized attempts to connect to TCP port 9993 and audit running processes for suspicious child processes spawned by the NitroSense service.

Compensating Controls: If an immediate update is not possible, restrict local user permissions to prevent execution of unauthorized software that could interact with local debugging ports.

Public Exploit Available: Unknown

Given that this vulnerability allows for arbitrary code execution on the host machine, it should be treated with high priority. Organizations utilizing affected Acer hardware should deploy the vendor provided update to version 5.2.84 immediately to remove the exposed debug interface and eliminate the attack vector.