Which versions of Acer Connect M6E are affected by CVE-2026-49190?

The Acer Connect M6E 5G Portable WiFi Router contains a critical command injection vulnerability (CVSS 9.4) that enables attackers to execute arbitrary operating system commands and install malicious…

How to fix or mitigate CVE-2026-49190?

24 hours: Identify all Acer Connect M6E 5G routers in your network; restrict access to management interfaces to trusted networks only; disable remote management if not operationally required. 7 days: Implement network segmentation isolating affected routers and deploy monitoring for suspicious command execution; review and enhance authentication controls for administrator access. 30 days: Engage Acer for patch timelines; evaluate hardware replacement if patches do not materialize within 90 days; implement persistent network monitoring and access logging as long-term compensating controls.

Acer Connect M6E CVE-2026-49190

Q: What is the CVSS score of CVE-2026-49190?

CVE-2026-49190 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34209 CRITICAL

OS Command Injection (CWE-78)

2026-06-04 Acer

GHSA-v76p-jwh5-4pcm

Command Injection Connect M6E 5G Portable Wifi Router

9.4

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:30 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

9.4 (CRITICAL)

DescriptionCVE.org

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.

AnalysisAI

Command injection in the Acer Connect M6E 5G Portable WiFi Router allows authenticated remote attackers to install arbitrary applications or execute operating system commands by abusing internal operation codes (opcodes) whose permission checks are not properly enforced. The flaw carries a CVSS 4.0 score of 9.4 (Critical) due to network reach, low attack complexity, and scope-changing impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV.

Technical ContextAI

The vulnerable device is the Acer Connect M6E 5G Portable WiFi Router (CPE: cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router), a consumer/SMB-grade cellular gateway exposing a management plane that dispatches requests via internal operation codes (opcodes). Each opcode is intended to be gated by a privilege/permission check, but the router's authorization layer fails to consistently evaluate those instructional permissions across the full opcode set, leaving privileged actions reachable from lower-privileged contexts. The root cause maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating attacker-supplied input is ultimately passed to a shell or command interpreter on the underlying Linux-based router firmware, enabling arbitrary command execution and unauthorized package/app installation.

RemediationAI

Patch available per vendor advisory at https://community.acer.com/en/kb/articles/19707 - administrators should consult that knowledge base article for the fixed firmware build and apply the update to every Acer Connect M6E unit in inventory, since no exact fixed version is enumerated in the available CVE data. Until the firmware update is deployed, restrict access to the router's web/management interface to trusted hosts only (disable any WAN-side or remote-management exposure), place the device behind a network ACL that blocks untrusted clients from reaching the admin TCP/UDP ports, and rotate all administrative credentials given the PR:L authentication requirement - a stolen or default low-privilege account is sufficient to exploit. Disabling guest Wi-Fi or isolating it with strict client-isolation rules reduces the pool of attackers who can reach the management plane, at the cost of guest-user convenience; treating the device as untrusted and tunneling its traffic through an upstream firewall is the highest-assurance compensating control.