Acer Predator Connect W6x CVE-2026-49195

The attacker must have layer-2/adjacent-network reachability to the router's LAN interface on TCP port 9000 (CVSS AV:A, not AV:N) - this means being on the same Wi-Fi SSID or wired segment, including guest or IoT networks if they are not isolated from the management subnet. No authentication, no user interaction, and no special configuration of the router is required: the mtk_dut listener is present in default shipping firmware of Predator Connect W6x at version W6x_GBL_2.00.000005 and earlier. Limiting factors: the vulnerability is not exploitable from the WAN side or across the internet without first obtaining LAN access, and devices behind effective client-isolation or VLAN segmentation cannot reach port 9000 on the router.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 8.7 because exploitation requires only adjacent-network access, no authentication, no user interaction, and yields high impact across confidentiality, integrity, and availability of the router - a realistic priority for any environment where untrusted devices share the LAN (guest Wi-Fi, IoT, multi-tenant residential). EPSS, SSVC, and KEV signals were not supplied in the input, and the issue is not listed in CISA KEV; no public exploit was identified at time of analysis, so widespread mass-exploitation appears unlikely today, but the AV:A (not AV:N) constraint is the main limiting factor - an attacker still needs a foothold on the LAN. The Acer community-knowledge-base reference is the only vendor source provided, and no fix version, EPSS score, or POC was included in the dataset, so urgency below the CVSS face value should be calibrated against whether the deployment exposes port 9000 to guest/IoT segments.

An attacker who joins the same LAN - for example via the guest Wi-Fi, a compromised smart-TV on the IoT SSID, or a malicious laptop on a shared home/office network - opens a raw TCP connection to the router on port 9000 and sends UCC commands to the exposed mtk_dut service. Because no authentication is required, the attacker can reconfigure the router, exfiltrate Wi-Fi credentials, pivot to other LAN hosts, or brick the device; no public exploit is identified at time of analysis, but the protocol is simple enough that a working PoC is trivial to construct from the binary.