CVE-2026-49195: Predator Connect W6x: unauthenticated Debug Service

Synopsis

An unauthenticated debug service on the Acer Predator Connect W6x router exposes the /sbin/mtk_dut binary on TCP port 9000, letting any attacker on the local network issue arbitrary UCC commands without credentials. The flaw is reachable from the adjacent LAN with no authentication and no user interaction, and successful exploitation yields full read, write, and disruption capability on the device. No fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  Exploitation requires adjacent-network access, meaning the attacker must be on the same LAN or VPN segment as the router.

• AuthenticationNot required

  The debug service on TCP port 9000 accepts commands with no credentials of any kind.

• Victim interactionNot required

  The attacker connects directly to the exposed port; no user action on the device is needed.

• Attack complexityDetail

  Attack complexity is low: the service is reliably reachable and accepts UCC commands without environmental preconditions.

Blast Radius

• Executes arbitrary UCC commands on the router, giving the attacker control over device behavior and configuration.
• Reads sensitive device state and traffic-handling data exposed through the debug interface.
• Modifies router configuration and persisted settings, enabling traffic redirection or persistent backdoors.
• Disrupts routing and connectivity for every client on the LAN by crashing or reconfiguring the service.