CVE-2026-49199: Acer Predator Connect W6x: command injection via MQTT
Acer Predator Connect W6x devices are affected by a command injection weakness (CWE-77) that can be triggered through crafted MQTT messages. The record states that this can lead to root-level code execution on the target device, and NVD rates it critical with a CVSS 3.1 base score of 9.8. No fixed version is listed in the record, so administrators should consult the vendor advisory and restrict MQTT exposure.
Overview
The record describes a command injection weakness (CWE-77) in the Acer Predator Connect W6x, triggered through crafted MQTT messages. The CNA is Acer, and NVD assigns a CVSS 3.1 base score of 9.8 (critical).
Impact
- According to the record, successful exploitation can result in root-level code execution on the target device.
- The NVD vector indicates high confidentiality, integrity and availability impact, with no privileges or user interaction required.
- Inference: devices reachable over MQTT on an exposed network segment carry the greatest practical risk.
Affected products and versions
- Acer Predator Connect W6x
- Acer Predator Connect W6x Firmware
The record expresses version boundaries as markers relative to a GBL firmware build, but those boundary identifiers cannot be confirmed in the format required here. The exact affected build range is therefore unknown, and the vendor advisory should be checked.
Exploitation status
This CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.02163 (percentile 0.82097), and the SSVC record lists exploitation as none and automatable as yes.
Remediation and mitigation
- The record lists no fixed version; this absence does not mean that no fix exists.
- Review the Acer community advisory article 19672 for vendor firmware guidance.
- Limit MQTT access to trusted hosts, isolate the device from untrusted networks, and apply vendor updates once they are confirmed for your model.
Detection guidance
- Monitor MQTT traffic for unusual message patterns or unexpected sources.
- Watch for unexpected processes, configuration changes or outbound connections originating from the device.
Limitations of the available information
The record does not include fixed versions, technical details of the vulnerable component, or vendor-confirmed exploitation data. Version boundaries are ambiguous in the source data, so the affected range cannot be determined with confidence.
Frequently asked questions
What is the vulnerability in CVE-2026-49199?
The record describes a command injection weakness (CWE-77) in Acer Predator Connect W6x devices that can be triggered by crafted MQTT messages, potentially leading to root-level code execution.
Is this CVE known to be actively exploited?
The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
Is a fixed version available?
The record lists no fixed version. This does not prove that no fix exists, so the vendor advisory should be reviewed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.