CVE-2026-49199: Predator Connect W6x: RCE via MQTT

Synopsis

This is a command injection vulnerability in the Acer Predator Connect W6x router that can be reached over the network through its MQTT message handler. An unauthenticated attacker who can send crafted MQTT messages to the device triggers shell command execution and gains root-level code execution, fully compromising the device. No fix has been published; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment Acer ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's MQTT listener over the network (AV:N).

• AuthenticationNot required

  No credentials are needed; the MQTT message handler accepts the crafted payload unauthenticated (PR:N).

• Victim interactionNot required

  No user action is needed on the device side; the attacker sends the message directly (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions or environmental factors.

Blast Radius

• Executes arbitrary commands as root on the Predator Connect W6x, giving full control of the device's operating system.
• Reads, modifies, or deletes any configuration, credentials, and traffic data stored on or passing through the router.
• Disrupts or disables routing and connectivity for every client behind the device, and can pivot to attack other systems on the LAN.
• Impacts extend beyond the device itself (SC:H/SI:H/SA:H), so a compromised router can be used to tamper with downstream hosts and services.