Which versions of Acer Connect M6E are affected by CVE-2026-49185?

Acer Connect M6E 5G Portable WiFi Router firmware ≤ M6E_AI_1.00.000019 contains a critical unauthenticated remote command injection vulnerability (CVSS 10.0) allowing attackers to execute arbitrary…

How to fix or mitigate CVE-2026-49185?

24 hours: Identify all Acer Connect M6E 5G routers in your environment and determine firmware versions (vulnerable if ≤ M6E_AI_1.00.000019); isolate or disconnect any affected units from production networks. 7 days: Contact Acer support for patch status and timeline; implement interim network controls (firewall rules, network segmentation) to restrict device access and monitor for exploitation attempts. 30 days: Apply vendor-released patch once available; if patch timeline is unacceptable, evaluate device replacement with alternative vendor product.

Acer Connect M6E CVE-2026-49185

Q: What is the CVSS score of CVE-2026-49185?

CVE-2026-49185 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34199 CRITICAL

OS Command Injection (CWE-78)

2026-06-04 Acer

GHSA-78x5-76fx-mcp6

Command Injection Connect M6E 5G Portable Wifi Router Acer

10.0

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 06:15 vuln.today

CVSS changed

Jun 04, 2026 - 04:22 NVD

10.0 (CRITICAL)

CVE Published

Jun 04, 2026 - 02:55 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.

AnalysisAI

Unauthenticated remote command injection in Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) allows attackers to inject OS commands via the FieldX MDM adb messaging topic, which forwards unverified payloads to Runtime.exec(). The CVSS 4.0 score of 10.0 with network attack vector and no authentication required indicates a critical, trivially exploitable flaw; no public exploit identified at time of analysis but the simplicity of the bug pattern makes weaponization straightforward.

Technical ContextAI

The affected component is the FieldX Mobile Device Management (MDM) messaging subsystem on the Acer Connect M6E 5G portable router, which exposes an adb (Android Debug Bridge) topic that accepts messages and dispatches them to Java's Runtime.exec() without input sanitization or allow-listing. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw - operator-controlled strings are concatenated into shell-interpreted command lines, so metacharacters such as ;, &&, |, and backticks break out of the intended command and execute attacker-chosen binaries. Because the underlying device runs an Android-derived firmware with adb plumbing exposed to an MDM message bus, commands likely execute with the privileges of the MDM daemon, which on consumer/portable routers is typically root or system.

RemediationAI

Consult the Acer advisory at https://community.acer.com/en/kb/articles/19707 and upgrade the Connect M6E firmware to the version released after M6E_AI_1.00.000019 - the input data does not name an exact fixed build, so Patch available per vendor advisory; verify the post-fix version string with Acer before deployment. Until patched, treat affected routers as untrusted edge devices: disable any remote/WAN management interfaces, do not expose the device's management or MDM ports to public networks (place the device behind a NAT/firewall that drops inbound traffic to its admin services), segment any LAN clients onto a separate VLAN so a router compromise does not pivot into corporate assets, and physically retire units used in high-risk travel until firmware can be confirmed updated. The trade-off of disabling MDM/adb-style management is loss of fleet-management functionality for organizations using FieldX MDM, which may require manual provisioning during the mitigation window.