CVE-2026-49198: Predator Connect W6x: MQTT Broker Access Control

Synopsis

Improper access control in the MQTT broker on the Acer Predator Connect W6x lets any authenticated client subscribe to wildcard topics and read every message flowing through the broker. The flaw is reachable over the network and only requires a low-privilege MQTT account, with successful exploitation exposing all MQTT traffic, including data from other tenants and devices, to the attacker. No fixed version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MQTT broker over the network on its listening port.

• AuthenticationRequired

  A low-privilege MQTT account is sufficient; no admin role is needed.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and does not require any user action.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring only a wildcard topic subscription.

Blast Radius

• Reads every MQTT message published through the broker, including topics belonging to other devices and tenants.
• Harvests credentials, device telemetry, and command payloads that transit the broker in cleartext.
• Expands disclosure beyond the vulnerable component, since broker traffic typically carries data from connected systems and downstream services.