CVE-2026-49186: Lack of MQTT Broker Topic Access Control Lists

Synopsis

This is a missing access-control vulnerability in the Acer Connect M6E 5G Portable WiFi Router firmware (versions up to and including M6E_AI_1.00.000019). The embedded MQTT broker runs without topic-level Access Control Lists, meaning any authenticated client that can reach the broker over the network can subscribe to all topics using wildcard characters or publish arbitrary control messages. Successful exploitation lets an attacker enumerate hidden network devices on the router and issue rogue commands to connected clients. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Acer publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MQTT broker service over the network; the broker listens on a network-accessible port on the router.

• AuthenticationRequired

  A privileged (admin-level) account credential is needed to connect as an MQTT client, though once authenticated no further topic-level restrictions are enforced.

• Victim interactionNot required

  No user interaction is needed; the attacker operates entirely against the broker service without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental setup beyond network access and valid credentials.

Blast Radius

• Attacker subscribes to all MQTT topics using wildcard characters, enumerating hidden devices and internal network topology information the broker carries.
• Attacker publishes rogue control commands to any topic, directing connected devices to take unintended actions.
• Confidentiality of all data in transit through the broker is compromised, including device state, sensor readings, and configuration payloads.
• Integrity of the router's connected-device ecosystem is compromised as injected commands can override legitimate control messages.