CVE-2026-49188: Elevated Root Command Execution via ai_cmd Sockets

Synopsis

An unauthenticated command injection vulnerability affects the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier). The ai_cmd utility runs as root and passes socket input directly to popen() without sanitization, allowing any attacker on an adjacent network to inject arbitrary shell commands with no credentials required. Successful exploitation gives the attacker full root-level command execution on the device. No fix version has been published; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (local LAN, Wi-Fi segment, or VPN) to reach the ai_cmd socket interface; remote internet-based access is not required but physical co-location on the same network segment is.

• AuthenticationNot required

  No credentials are required; the ai_cmd socket interface accepts input from unauthenticated users.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends socket input directly to the vulnerable service without any user action on the target device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• The attacker executes arbitrary commands as root on the router, gaining full administrative control over the device firmware and OS.
• The attacker can read all data stored or transiting the device, including Wi-Fi credentials, DHCP leases, and connected-client information.
• The attacker can modify router configuration, redirect DNS, or inject traffic rules, affecting all devices on the network segment served by the router.
• The attacker can crash or reboot the router, disrupting network connectivity for all clients depending on it.