Which versions of Predator Connect W6x are affected by CVE-2026-49199?

Acer Predator Connect W6x routers contain a critical remote code execution vulnerability (CVSS 10.0) allowing unauthenticated attackers to gain root-level access without user interaction, creating…

How to fix or mitigate CVE-2026-49199?

Within 24 hours: Inventory all Acer Predator Connect W6x routers in production; verify firmware versions against W6x_GBL_2.00.000005; isolate affected units from trusted networks or apply restrictive inbound firewall rules. Within 7 days: Deploy network monitoring signatures for malicious MQTT command injection attempts; contact Acer support for patch timeline and escalate to procurement for temporary replacement router evaluation. Within 30 days: Implement timeline for firmware patching once released (subscribe to security.acer.com advisories for W6x updates) or complete hardware replacement pending patch availability assessment.

Predator Connect W6x CVE-2026-49199

Q: What is the CVSS score of CVE-2026-49199?

CVE-2026-49199 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-33269 CRITICAL

Command Injection (CWE-77)

2026-05-29 Acer

GHSA-2456-wh5h-jwph

Command Injection RCE Predator Connect W6X

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 11:20 vuln.today

CVSS changed

May 29, 2026 - 09:22 NVD

10.0 (CRITICAL)

CVE Published

May 29, 2026 - 08:38 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

AnalysisAI

Remote unauthenticated command injection in the Acer Predator Connect W6x router enables root-level code execution via crafted MQTT messages, scoring a maximum 10.0 CVSS v4.0 across all impact metrics including subsequent system impact. The flaw was disclosed by Acer and tracked in the ENISA EUVD as EUVD-2026-33269, but no public exploit identified at time of analysis. Affects firmware W6x_GBL_2.00.000005 and earlier, with no special authentication or user interaction required.

Technical ContextAI

The Predator Connect W6x is Acer's Wi-Fi 6E mesh router, which exposes an MQTT (Message Queuing Telemetry Transport) interface - a lightweight pub/sub protocol commonly used for IoT device telemetry and remote management. The vulnerability falls under CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the MQTT message handler passes attacker-controlled fields into a shell or system call without sanitizing metacharacters such as ;, &&, |, or backticks. Because router daemons typically run as root for hardware access, successful injection yields full device compromise rather than a confined service account.

RemediationAI

Patch availability is not explicitly enumerated in the supplied data - Patch available per vendor advisory at https://community.acer.com/en/kb/articles/19672, which administrators should consult for the exact fixed firmware build superseding W6x_GBL_2.00.000005. Until the device is updated, restrict access to the MQTT service (commonly TCP/1883 and TLS/8883) by blocking those ports at the WAN edge and on any untrusted LAN segments, and disable any cloud/remote-management feature on the router that relies on MQTT - note that this will break the Predator Connect mobile app and remote telemetry. Segment the router's management plane onto a trusted VLAN, and monitor for unexpected outbound connections from the device that could indicate prior compromise; factory-reset and re-flash any unit suspected of exposure before applying the patch.