Acer Connect M6E CVE-2026-49194

Exploitation requires (1) network reachability to the Acer Connect M6E management/debug interface - typically meaning the attacker is associated to the router's WiFi or otherwise on a network where the management plane is exposed, and (2) at least low-privileged authentication to the device (CVSS PR:L), so a fully anonymous Internet attacker against a default-configured device is not the documented threat model. The specific trigger is invocation of the debug routine SCREEN_CLICK with opcode 5053; no user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). Limiting factors: the device is a portable router (small deployed footprint compared with home gateways), WAN-side management is typically disabled by default, and PR:L means stolen or guest credentials are a prerequisite.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H with subsequent-system impact S:H across CIA is consistent with a network-reachable debug routine that grants shell on a network gateway device - high real-world impact because the router brokers all client traffic. PR:L indicates some level of authenticated access is needed to invoke the routine, so the worst-case 'pre-auth RCE' framing should be tempered: an attacker still needs at least low-privileged access (likely a normal user session or LAN foothold) before triggering the bypass. EPSS, KEV, and SSVC data were not supplied, and no public exploit identified at time of analysis; the single reference is the vendor knowledge-base article, so exploitation likelihood beyond the vendor disclosure is currently unknown. Defenders managing fleets of these routers should still treat it as high-priority given the trivial post-auth pivot to full shell.

An attacker who has obtained low-privileged credentials to the router (for example, a guest WiFi user or a captured normal-user login) sends the SCREEN_CLICK(5053) request to the management endpoint; instead of prompting for the device login, the firmware drops the connection straight into an interactive shell on the router. From that shell the attacker can dump WiFi/PSK material, modify DNS, install persistence, or pivot to clients behind the router. No public exploit identified at time of analysis, but the bypass is a single deterministic command once the routine is reachable.