CVE-2026-49197: Acer Predator Connect W6x: Improper Authentication

Overview

Acer has published a record for CVE-2026-49197 affecting web endpoints intended for the Acer Connect app on the Predator Connect W6x. According to the record, these endpoints do not reject requests when Base64 decoding of the HTTP Authorization header fails, which is mapped to CWE-287 (Improper Authentication). The primary source is the Acer community advisory.

Impact

• NVD assigns a CVSS score of 9.8 (critical). Its vector describes network reachability, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
• A second score of 10 on the newer CVSS framework is listed for the Acer CNA and another provider.
• The record does not describe which data or actions the endpoints expose, so the real-world consequences are unknown.

Affected products and versions

• Acer Predator Connect W6x, with a version boundary recorded only as build 00.000005.
• Acer Predator Connect W6x Firmware, with a version boundary recorded as the same build 00.000005.
• The two entries use opposite comparison directions (at or above, and at or below) against the same build, so the exact affected range should be confirmed with the vendor advisory.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The record's SSVC data marks exploitation as none, while it marks the issue as automatable with total technical impact. The EPSS probability is 0.00525, with a percentile of 0.43706.

Remediation and mitigation

• The record contains no fixed version. The absence of a listed fix does not mean none exists, so check the vendor advisory for firmware or app updates.
• Apply vendor updates to the W6x devices and the Acer Connect app as soon as they are available.
• Until a fix is confirmed, limit network exposure of the device management and app-facing web endpoints, for example by restricting access to trusted networks and disabling remote access where it is not needed.
• Review the device inventory to identify all W6x units and their firmware builds.

Detection guidance

• Review web server or device logs for requests with malformed or non-decodable Authorization headers that were nonetheless accepted with successful responses.
• Monitor for unexpected access to the Acer Connect endpoints from unfamiliar sources.
• Keep logging of authentication-related events enabled and forward it to a central system for correlation.

Limitations of the available information

• The record does not provide the exact endpoint paths, the exact affected build range, or a fixed version.
• It does not describe a proof of concept or the observed behavior in production.
• The two CVSS scores come from different frameworks and providers, and the record does not explain the difference.
• Details should be verified against the NVD entry and the CVE Record.

Frequently asked questions

What is the core problem in CVE-2026-49197?

According to the record, the web endpoints for the Acer Connect app do not block requests when Base64 decoding of the Authorization header fails. This is classified as improper authentication (CWE-287).

Is this CVE being actively exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record's SSVC exploitation value is none.

Is there a fixed version?

The record lists no fixed version. Check the Acer advisory for updates, since the absence of a listed fix does not mean none exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.