CVE-2026-49188 is a critical flaw (CVSS 9.8) in the Acer Connect M6E 5G. The ai_cmd utility runs with full root permissions and pipes socket input directly to popen(), so unauthenticated users could run root commands. Install the firmware update named in Acer's knowledge base article 19707.
What's affected
Acer Connect M6E 5G and its firmware, as the record lists. No firmware versions are given in the record, and Acer article 19707 is the reference for the affected and fixed firmware.
The vector is network based, with no privileges and no user interaction needed.
How to check if you're exposed
Find Acer Connect M6E 5G units in use, including spares and field devices. Read the firmware version in the device admin page and compare it with the fixed firmware named in Acer's article 19707.
The Acer page was protected by a browser check and did not load for our review, so read it directly for the fixed firmware version.
What to do now
- Find all Acer Connect M6E 5G devices and note their firmware versions.
- Read Acer article 19707 and install the fixed firmware it names.
- Keep the device management and local services off untrusted networks until the update is applied.
- If the device cannot be updated, consider replacing it, and change any credentials that were stored on it.
Why it matters
The record classes this as CWE-489, active debug code. A utility with powerful rights that listens on a socket and feeds its input to a shell style call is the kind of leftover tool that should not ship in a product build. Combined with root permissions, anything it accepts runs with total control of the device.
The same advisory covers two sibling flaws, CVE-2026-49185 and CVE-2026-49186. Together they show an edge device with several routes to control, so updating the firmware is the one fix that covers all three. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-49188 is a handy place to follow later updates.
Quick check
Why does root matter?
A process running as root can change any file and setting on the device, so a flaw in it hands over the whole system.
Sources
Last reviewed: 19 October 2026.
