Acer
58 CVEs across 145 Acer products. Browse Acer vulnerabilities, severities, and proof-of-concept exploits.
Acer products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50226 | Medium | 5.3 | 2026-06-04 | Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorize… |
CVE-2026-50225 | Critical | 9.1 | 2026-06-04 | The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database. |
CVE-2026-50224 | Medium | 4.9 | 2026-06-04 | The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints re… |
CVE-2026-50214 | Critical | 9.8 | 2026-06-04 | The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access p… |
CVE-2026-50213 | High | 7.5 | 2026-06-04 | The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification… |
CVE-2026-50212 | Medium | 6.5 | 2026-06-04 | Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of se… |
CVE-2026-50211 | Critical | 9.8 | 2026-06-04 | Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRA… |
CVE-2026-50210 | High | 7.5 | 2026-06-04 | The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryp… |
CVE-2026-50209 | High | 7.8 | 2026-06-04 | Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to… |
CVE-2026-50208 | Critical | 9.4 | 2026-06-04 | High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM… |
CVE-2026-50207 | High | 7.8 | 2026-06-04 | The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connecti… |
CVE-2026-50206 | Medium | 6.8 | 2026-06-04 | Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files. |
CVE-2026-50205 | High | 8.2 | 2026-06-04 | System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data. |
CVE-2026-49204 | Medium | 6.5 | 2026-06-04 | Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation. |
CVE-2026-49203 | High | 8.3 | 2026-06-04 | Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted. |
CVE-2026-49202 | High | 8.6 | 2026-06-04 | Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-si… |
CVE-2026-49194 | High | 8.8 | 2026-06-04 | The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interfa… |
CVE-2026-49193 | High | 7.5 | 2026-06-04 | Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet. |
CVE-2026-49192 | Medium | 5.4 | 2026-06-04 | The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scr… |
CVE-2026-49191 | Critical | 9.8 | 2026-06-04 | The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages. |
CVE-2026-49190 | High | 8.8 | 2026-06-04 | The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or c… |
CVE-2026-49189 | High | 7.8 | 2026-06-04 | Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations. |
CVE-2026-49188 | Critical | 9.8 | 2026-06-04 | The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitra… |
CVE-2026-49187 | High | 7.5 | 2026-06-04 | The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse. |
CVE-2026-49186 | Critical | 9.8 | 2026-06-04 | The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enume… |
CVE-2026-49185 | Critical | 9.8 | 2026-06-04 | The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection. |
CVE-2026-49201 | Critical | 9.8 | 2026-05-29 | The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-e… |
CVE-2026-49200 | Critical | 9.8 | 2026-05-29 | The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for we… |
CVE-2026-49199 | Critical | 9.8 | 2026-05-29 | Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device. |
CVE-2026-49198 | Medium | 4.9 | 2026-05-29 | Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors. |
CVE-2026-49197 | Critical | 9.8 | 2026-05-29 | Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails. |
CVE-2026-49196 | High | 7.2 | 2026-05-29 | The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands. |
CVE-2026-49195 | High | 8.8 | 2026-05-29 | Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrar… |
CVE-2026-9789 | | 2026-05-28 | A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgen… | |
CVE-2026-9490 | Medium | 5.5 | 2026-05-25 | A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerabil… |
CVE-2026-9489 | | 2026-05-25 | NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to… | |
CVE-2026-8069 | High | 7.8 | 2026-05-08 | PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom… |
CVE-2019-25302 | High | 7.8 | 2026-02-06 | Acer Launch Manager 6.1.7600.16385 contains an unquoted service path vulnerability in the DsiWMIService that allows local users to potentially execute code wit… |
CVE-2020-36976 | High | 7.8 | 2026-01-27 | Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially ex… |
CVE-2021-47826 | High | 7.8 | 2026-01-16 | Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arb… |
CVE-2021-47825 | High | 7.8 | 2026-01-16 | Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges. Attack… |
CVE-2021-47823 | High | 7.8 | 2026-01-16 | Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges… |
CVE-2025-14305 | High | 7.8 | 2025-12-17 | ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replace ListCheck.exe with a malicious execut… |
CVE-2025-5491 | High | 8.8 | 2025-06-13 | Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functi… |
CVE-2024-8105 | Medium | 6.4 | 2024-08-26 | A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK privat… |
CVE-2023-48034 | Medium | 6.1 | 2023-11-27 | An issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to both decrypt wireless keystrokes and inject arbitrary keystrokes… |
CVE-2022-40080 | High | 7.8 | 2023-02-16 | Stack overflow vulnerability in Aspire E5-475G 's BIOS firmware, in the FpGui module, a second call to GetVariable services allows local attackers to execute a… |
CVE-2022-4020 | High | 8.1 | 2022-11-28 | Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot set… |
CVE-2022-41415 | Critical | 9.8 | 2022-10-19 | Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a… |
CVE-2022-30426 | High | 7.8 | 2022-09-23 | There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit… |
CVE-2022-24286 | High | 7.8 | 2022-03-10 | Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates w… |
CVE-2022-24285 | High | 7.8 | 2022-03-10 | Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authori… |
CVE-2021-45975 | High | 7.8 | 2022-01-26 | In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local attacker to perform a D… |
CVE-2019-18670 | High | 7.8 | 2019-12-17 | In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an… |
CVE-2017-15361 | Medium | 5.9 | 2017-10-16 | The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b… |
CVE-2016-5648 | Medium | 5.3 | 2017-06-08 | Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack… |
CVE-2012-2864 | | 2012-08-22 | Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Seri… | |
CVE-2012-3290 | | 2012-06-07 | Multiple unspecified vulnerabilities in Google Chrome before 20.0.1132.22 on the Acer AC700; Samsung Series 5, 5 550, and Chromebox 3; and Cr-48 Chromebook pla… | |
CVE-2012-1418 | | 2012-02-29 | Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impac… | |
CVE-2012-0695 | | 2012-01-12 | Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impac… | |
CVE-2011-4719 | | 2011-12-09 | Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impac… | |
CVE-2011-4548 | | 2011-11-24 | Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impac… | |
CVE-2011-3421 | | 2011-09-12 | Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.125 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impa… | |
CVE-2011-3420 | | 2011-09-12 | Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.157 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impa… | |
CVE-2009-2627 | | 2009-08-19 | Insecure method vulnerability in the Acer LunchApp (aka AcerCtrls.APlunch) ActiveX control in acerctrl.ocx allows remote attackers to execute arbitrary command… | |
CVE-2006-6121 | | 2006-11-26 | Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run method. |