CVE-2026-49194: SCREEN_CLICK Authentication Bypass

Synopsis

An authentication bypass vulnerability affects the Acer Connect M6E 5G Portable WiFi Router running firmware version M6E_AI_1.00.000019 and earlier. The flaw is reachable over the network and requires only a low-privilege account, allowing an attacker to invoke the SCREEN_CLICK(5053) debugging routine to skip the device login prompt entirely and drop into an interactive shell. Successful exploitation gives an attacker full control over the router, including reading, modifying, and disrupting all traffic and configuration handled by the device. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Acer publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's management interface over the network; the SCREEN_CLICK debugging routine is exposed as a network-accessible service.

• AuthenticationRequired

  A low-privilege account credential is sufficient to trigger the bypass; no administrative access is needed to invoke the vulnerable debugging routine.

• Victim interactionNot required

  No user or administrator action on the target device is needed; the attacker initiates the exploit entirely without victim participation.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required to successfully invoke the SCREEN_CLICK bypass.

Blast Radius

• Attacker gains an interactive root-level shell on the router, with full read access to stored credentials, Wi-Fi passphrases, and device configuration.
• Attacker can modify routing tables, firewall rules, and DNS settings, redirecting or intercepting all traffic passing through the device.
• Attacker can crash or reboot the router, cutting off network connectivity for all clients depending on it.
• Compromise of the router's management plane extends to any connected network segments, enabling lateral movement into adjacent systems reachable through the device.