CVE-2026-49199
A vulnerability in Acer Predator Connect W6x firmware allows attackers to send specially crafted MQTT messages that cause the device to execute arbitrary commands with root privileges. This flaw can be exploited remotely without authentication or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Acer Predator Connect W6x firmware and the Acer Predator Connect W6x device.
Real-world impact
An attacker could take full control of the device, install malware, exfiltrate data, or use it as a launch point for further attacks.
Why this severity
The CVSS score of 10 reflects the combination of remote exploitation, no authentication required, and the ability to execute commands with full system privileges, giving an attacker complete control over the affected device.
What to do about it
- ›Block or filter MQTT traffic to the device to prevent malicious messages from reaching it.
- ›Restrict network access to the device, limiting exposure to trusted networks only.
- ›Monitor device logs for unusual MQTT activity and investigate promptly.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in the provided sources.
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- community.acer.com/en/kb/articles/19672vendor advisory