CVE-2026-49199 is a critical (CVSS 9.8) command injection in Acer Predator Connect W6X firmware. Crafted MQTT messages can lead to code execution as root on the device. The record names no fixed version, so check Acer's advisory (article 19672) and install the firmware update it points to.
What's affected
- Product: Acer Predator Connect W6X, hardware and firmware.
- Fixed version: not stated in the CVE record. Check Acer's advisory (article 19672).
- Weakness: CWE-77, improper neutralization of special elements in a command.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Published 29 May 2026. Not marked as exploited in CISA KEV.
How to check if you're exposed
Acer ships these devices as consumer networking hardware, so there is no package manager to query. Use the device itself.
- Log in to the Acer Predator Connect W6X admin page or the Acer Connect app and note the firmware version shown in the device or system information screen.
- Open the Acer advisory named in the Sources section and compare your version with the fixed firmware it lists.
- If the admin page or any service on the device is reachable from the internet, treat that as a separate problem and close it, whatever the firmware version.
If you manage a network, also look for any MQTT traffic leaving or entering the device that you do not expect. That is a signal worth knowing about regardless of this CVE.
What to do now
- Open the Acer advisory (knowledge base article 19672) and confirm which Acer Predator Connect W6X firmware fixes this CVE. The CVE record does not name a fixed version, so do not assume one.
- Install the fixed firmware through the vendor update path as soon as it is available for your unit.
- Until then, keep the admin interface off the internet and limit it to a trusted management network.
- Change any password or key that was stored on or sent through the device if you think it may have been exposed.
- Add the device to your asset inventory with its firmware version so the next advisory is easy to match.
Why it matters
MQTT is a lightweight messaging protocol common on connected devices. When the device builds a system command out of a message field without cleaning it, the sender decides what runs. Running as root means the result is full control of the router.
Command injection is one of the oldest bug classes, and the fix is just as old: never pass message content to a shell, and use fixed argument lists with strict validation. The record classifies this as CWE-77.
Quick check
Does the record describe how to trigger it?
No, and this post will not either. The advisory level is enough for defenders: patch, and restrict who can reach the device.
Sources
- Acer knowledge base article 19672 (named in the CVE record; the page was behind a browser check when I tried to read it, so the details here come from the CVE record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
