External risk intelligence

FieldX MDM Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-49185

The vulnerability exists in Mobile Device Management (MDM) and router firmware for the Acer Connect M6E 5G. Such devices are typically deployed as internet-facing gateways or edge network devices, making their management interfaces or associated messaging services plausible targets for remote access from the internet.

OS Command Injection

Acer Connect M6e 5g Firmware

m6e_ai_1.00.000019 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects device management software, where unverified commands can be directly executed, potentially leading to unauthorized control and data compromise. Given its network-accessible nature and critical severity, understanding its presence within your environment is a priority.

Unverified commands can be directly executed.
Critical flaw impacts network-facing devices.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted messages to the FieldX MDM's adb messaging topic. Because these messages are not verified, they can be injected directly into the system's runtime, allowing the attacker to execute arbitrary commands on the affected device. This could lead to a complete compromise of the device's security.

No authentication required to access.
Unverified adb messaging topic.
Attacker can run any command.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject commands into the device's operating system through the FieldX MDM adb messaging topic. This could lead to unauthorized modification or disclosure of system data, and potentially impact the device's intended service behavior when such payloads are accepted.

System commands could be injected.
Unverified payloads are passed to `Runtime.exec()`.
Unauthorized system access or control may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in FieldX MDM allows unverified payloads to be passed directly into `Runtime.exec()`, creating a command injection risk. This could impact organizations utilizing the Acer Connect M6E 5G firmware, where the MDM's adb messaging topic is affected. Initial triage should focus on identifying all instances of the affected firmware, assessing their exposure to the internet, and confirming the business criticality and ownership of each device.

Identify affected devices and ownership.
Verify internet reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FieldX MDM used for?

FieldX MDM is a Mobile Device Management component integrated into the Acer Connect M6E 5G router firmware. It allows administrators to remotely monitor, configure, and manage these networking devices, which typically act as gateways for connectivity. By centralizing control, it helps maintain and update firmware or settings across deployed units in a network environment.

What is the nature of CVE-2026-49185?

This vulnerability is a command injection flaw, categorized as CWE-78. It occurs because the software takes input from an adb messaging topic and feeds it directly into a system function called Runtime.exec() without verifying the content. Essentially, the device fails to distinguish between legitimate management instructions and malicious commands, allowing an attacker to execute arbitrary actions on the underlying operating system.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted message to the adb messaging topic used by the MDM. The system processes these messages automatically. Importantly, the vulnerability does not require authentication, meaning the attacker does not need a valid password or prior access to the device to submit a payload that the system will then execute.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal flags this as external because the Acer Connect M6E 5G is frequently deployed as an internet-facing gateway. Since the messaging topic is reachable over the network and does not require authentication, the device's management interface is exposed to anyone on the internet, significantly increasing the likelihood that it could be reached and compromised.

What steps should I take if I use Acer Connect M6E 5G?

First, create an inventory of all Connect M6E 5G devices in your environment to identify which are running the affected firmware versions. Once identified, evaluate whether these devices are accessible via the internet. Prioritize restricting network access to these management interfaces and verify business criticality to determine the urgency of your internal patch deployment process.

References

community.acer.com/en/kb/articles/19707

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.