CVE-2026-49188: Acer Connect M6E 5G ai_cmd Root Command Execution via Sockets
The ai_cmd utility in Acer Connect M6E 5G firmware is described as running with full root permissions and passing socket input directly to popen(), which may allow unauthenticated users to run arbitrary root commands. NVD assigns a critical base score of 9.8, while the vendor's reference lists a mitigation rather than a confirmed patch. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-49188 describes a flaw in the ai_cmd utility on Acer Connect M6E 5G devices. According to the record, ai_cmd runs with full root permissions and pipes socket inputs directly to popen(), which may let unauthenticated users execute arbitrary commands as root.
Impact
- The record describes possible execution of arbitrary commands with root privileges.
- The NVD vector, as recorded, indicates network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
- The CWE classification in the record is CWE-489; no weakness name is provided in the record.
Affected products and versions
- Acer Connect M6e 5G Firmware: versions up to and including 00.000019 as listed in the record.
- Acer Connect M6E 5G Portable WiFi Router: versions up to and including 00.000019 as listed in the record.
- The record lists affected versions only in an upper-bound form; the exact lower bound is unknown.
Exploitation status
The record shows no KEV listing, an EPSS probability of 0.00628 with percentile 0.49463, and an SSVC exploitation value of none. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- The only fix entry in the record is a mitigation reference from the vendor community article: Acer community article 19707.
- Review the vendor guidance and confirm whether a firmware update or other remediation is available for your model and version.
- Restrict access to the device management and socket interfaces to trusted networks until guidance is verified.
Detection guidance
- Inventory Acer Connect M6E 5G devices and record firmware versions.
- Monitor device logs and network traffic for unexpected connections to local services and for unusual process activity, where the platform allows it.
- Treat unexplained privileged process behavior on these devices as a potential indicator and escalate to the incident response process.
Limitations of the available information
- The record does not provide a confirmed patched version.
- The record does not describe the exact socket protocol, port or exposure conditions.
- Exploitation evidence beyond the sources consulted is unknown.
- A missing fixed version does not confirm that no fix exists; consult the vendor advisory.
Frequently asked questions
What is the core problem in CVE-2026-49188?
According to the record, the ai_cmd utility runs with root permissions and passes socket input directly to popen(), which may allow unauthenticated users to run arbitrary root commands.
Is there a confirmed patch?
The record lists only a vendor mitigation reference. No confirmed patched version is given, so check the vendor advisory for current guidance.
Is this vulnerability known to be exploited?
The record shows no KEV listing, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.