CVE-2023-48034

CVE-2023-48034 我发现了 Acer 无线键盘 SK-9662（FCC ID: H4IKB9662）无线协议中使用的弱加密。这种弱加密使攻击者能够轻松监控和记录按键，并注入任意按键。 简介 该键盘使用德州仪器 CC2545 芯片，通过 Nordic Semiconductors 开发的 Enhanced Shockburst 协议传输数据。载荷由 12 个字节组成，第一个字节似乎是常量值（在我的测试中为 0x48）。第二个字节是修饰键字节（ctrl、shift...

CVE-2026-9490

CVE ID: CVE-2026-9490 研究者: Vo Duc Thang ugvxb 謝辞: https://community.acer.com/en/kb/articles/19668 1. 概要 Acer Care Center サービス ACCSvc.exe に重大なセキュリティ脆弱性が特定されました。この脆弱性により、認証された任意のローカルユーザーがシステムサービスをクラッシュさせ サービス拒否、さらに弱いセキュリティ設定の名前付きパイプインターフェースを通じて特権を昇格させる可能性があります。 SYSTEM 権限 LocalSystem...

CVE-2026-9789

CVE ID: CVE-2026-9789 研究者: Vo Duc Thang ugvxb 謝辞: https://community.acer.com/en/kb/articles/19670 PoC動画: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. エグゼクティブサマリー エイサー NitroSense ソフトウェア PSAdminAgent.exe に、重大なローカル権限昇格の脆弱性が発見されました。この脆弱性により、認証されたローカルユーザーが...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

CVE-2026-50601 affects the Planet9 desktop application, where a hardcoded read-only API key allows unauthorized access to internal repositories. An attacker could use this access to extract embedded administrative keys and secrets, potentially gaining administrative control over repository infras...

CVE-2026-50601 Planet9 Hardcoded Credentials Vulnerability Information

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50226

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

CVE-2026-49200

The acercgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials for web and Telnet, leading to unauthorized system access...

CVE-2026-49197

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails...

CVE-2026-9789

A Local Privilege Escalation LPE vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List ACL. This allows any authenticated local user to connect and send...

CVE-2026-50226 Firmware Theft & IMEI Spoofing via Connect-OTA

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability, which stems from overly permissive configuration settings of the cloud storage container. This vulnerability may lead to the unauthorized disclosure of activ...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the hardcoded nature of the APK resource files, which are never expired and share credentials, potentially leading to informati...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability, which stems from the FieldX MDM adb messaging topic directly passing unvalidated payloads to Runtime.exec, potentially leading to command injection...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the ability to access internal multimedia session archives without authentication, and lax cross-site resource sharing rules...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability, which stems from the system log files outputting unencrypted SMTP server authentication passwords and sensitive employee corporate identity data...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the lack of a bot mitigation mechanism in the /v1/account/register registration path, which may allow malicious automated syste...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability, which stems from the legacy debugging module containing fixed credentials from the AWS Cognito test sandbox. This vulnerability could potentially lead to...

Acer M6E 安全漏洞

The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability. This vulnerability stems from the account verification endpoint/v1/User/validate, which returns a full set of user profile data tables. It is possible to...