External risk intelligence

Acer Connect M6E 5G Firmware Instruction Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-49190

The affected product is a 5G router/gateway device. These devices are designed to act as internet-facing edge networking equipment, which makes their administrative and internal command interfaces commonly reachable in internet-connected deployments.

OS Command Injection

Acer Connect M6e 5g Firmware

m6e_ai_1.00.000019 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified that allows unauthorized installation of applications or execution of commands due to a flaw in how the system manages permissions for internal operations. This issue affects certain Acer Connect M6E 5G firmware. The primary concern is to confirm if this specific technology is in use within our environment and assess any potential exposure.

Flaw permits unauthorized command execution.
Leadership should track if Acer 5G routers are deployed.
Confirm relevance and potential exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging a low-privileged account to interact with the system's internal operation codes. This interaction bypasses necessary permission checks, potentially allowing the attacker to install unauthorized applications or execute arbitrary commands on the affected system.

Attacker needs low-privileged access.
Vulnerability triggered by internal operation codes.
Risk includes unauthorized app installs or command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with low privileges to install unauthorized applications or execute arbitrary commands on the affected system. This is possible because the system does not properly enforce permissions for certain internal operations.

Unauthorized application installation.
Command execution via internal opcodes.
System compromise or data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability likely falls to the platform or infrastructure teams managing the affected devices, with support from network and security teams for exposure assessment and vendor management for remediation. The immediate practical step is to identify all instances of the affected technology, confirm their network exposure and business criticality, and then assign ownership for a risk-based remediation plan.

Platform/Infrastructure teams own the issue.
Verify device exposure and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Acer Connect M6E 5G?

The Acer Connect M6E 5G is a 5G router and gateway device. It provides high-speed wireless connectivity for local networks by bridging 5G cellular signals to wired and Wi-Fi connections. These units are typically used as edge networking equipment to manage traffic flow between the internet and internal devices.

What does CVE-2026-49190 mean?

CVE-2026-49190 refers to an improper enforcement of permission checks, categorized as CWE-78 (OS Command Injection). Because the system fails to correctly validate user rights when handling certain internal operation codes, it allows unauthorized parties to execute arbitrary commands or install software on the router.

How is this vulnerability triggered?

An attacker must have low-privileged account access to the device to interact with the system's internal operation codes. The flaw is specifically triggered by exploiting the failure to verify permissions for these codes. It is not triggered by standard, unauthenticated traffic sent to the device without first establishing the required low-level session.

Why should I care about this CVE?

Halo Surface Signal notes that since the Acer Connect M6E 5G is an edge networking device, its administrative interfaces are often reachable from the internet. If your router is configured to face the public internet, the risk is elevated because the internal command interfaces that this vulnerability affects may be accessible to remote actors.

How do I respond to this threat?

Start by identifying all Acer Connect M6E 5G units within your infrastructure. Once located, verify their network placement—specifically whether they are exposed to the public internet—and assess their role in your environment. Prioritize these devices for remediation by coordinating with infrastructure teams to track vendor updates or apply necessary configuration changes.

References

community.acer.com/en/kb/articles/19707

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.