CVE-2026-49196: Predator Connect W6x: Web Interface Command Injection

Synopsis

This is a command injection flaw in the Predator Connect W6x web interface, where the Wi-Fi device blocking feature does not sanitize MAC address input before passing it to a shell. An attacker who can reach the web interface over the network and authenticate with an administrative account can inject arbitrary shell commands. Successful exploitation runs attacker-chosen commands on the device with full read, write, and availability impact on the router. No fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web management interface over the network.

• AuthenticationRequired

  An administrative account on the router is required to access the device blocking feature.

• Victim interactionNot required

  No user interaction is needed; the attacker drives the exploit directly against the web interface.

• Attack complexityDetail

  Attack complexity is low: the injection is reliable and does not depend on race conditions or memory layout.

Blast Radius

• Executes arbitrary shell commands on the router with the privileges of the web interface backend.
• Reads sensitive device state including configuration, credentials, and connected-client data.
• Modifies router configuration, firewall rules, DNS settings, and persisted firmware state.
• Disrupts or disables the router, cutting network availability for all clients behind it.