CVE-2026-49197
A vulnerability in Acer Connect app's web endpoints allows attackers to bypass authentication when the HTTP Authorization header fails to decode properly. This flaw could let an attacker send requests that are treated as authorized, potentially accessing sensitive data or controlling the device. The issue is critical due to its high impact on confidentiality, integrity, and availability.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Acer Predator Connect W6X firmware and the Acer Predator Connect W6X app. Users of Acer Predator Connect devices that run the W6X firmware and use the Connect app.
Real-world impact
An attacker could send crafted requests that bypass authentication, gaining unauthorized access to the device's functions or data.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network with no authentication, and it can compromise confidentiality, integrity, and availability of the device.
What to do about it
- ›Avoid using the affected endpoints
- ›Disable the Acer Connect app
- ›Restrict network access to the endpoints
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- community.acer.com/en/kb/articles/19672vendor advisory