CVE Intelligence
Analysis AI-assisted

CVE-2026-49186: Acer Connect M6E 5G MQTT Broker Missing Topic ACLs

The local MQTT broker in the Acer Connect M6E 5G router does not enforce topic-level Access Control Lists, according to the CNA record. The record states that any client can use wildcard subscriptions to enumerate hidden network devices or publish rogue control commands. NVD assigns a base score of 9.8, and the sources consulted show no confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The CNA record describes a missing topic-level access control in the local MQTT broker of the Acer Connect M6E 5G products. The weakness is classified as CWE-287 (Improper Authentication). Vendor guidance is available in the Acer community article.

Impact

  • The record states that any client can subscribe with wildcard characters to enumerate hidden network devices.
  • The record states that any client can publish rogue control commands.
  • NVD base score is 9.8 (critical). Acer's CNA record includes a separate score of 8.6.

Affected products and versions

  • Acer Connect M6e 5g Firmware, up to and including 00.000019 as listed in the record.
  • Acer Connect M6E 5G Portable WiFi Router, up to and including 00.000019 as listed in the record.

No fixed version is stated in the record.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • The record's SSVC data indicates exploitation as none and automatable as no.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The only fix entry in the record is of type mitigation, linked to the Acer community article. Review that article and apply the vendor's guidance.
  • Restrict network access to the device's management and messaging interfaces so that only trusted clients can reach them.
  • Inventory the devices and confirm the firmware level against the affected version range.

Detection guidance

  • Review broker configuration for the presence of topic access restrictions.
  • Monitor for unexpected client connections to the broker from untrusted network segments.
  • Watch for control messages originating from clients that are not expected controllers of the device.

Limitations of the available information

  • The record does not provide a fixed firmware version, so the availability of a full patch is unknown.
  • The record does not describe the broker software, protocol configuration details, or the set of topics exposed.
  • The EPSS probability of 0.00466 is a statistical estimate and does not confirm exploitation.

Frequently asked questions

What is the core weakness in CVE-2026-49186?

According to the CNA record, the local MQTT broker does not enforce topic-level access control lists, so any client can subscribe with wildcards or publish control commands.

Is there a confirmed fix for this issue?

The record lists only a mitigation entry from Acer's community article and does not state a fixed version. Whether a full patch exists is unknown from the available data.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.