CVE-2026-50206: VPN Command Injection Vulnerability

Synopsis

A command injection vulnerability affects the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier). The flaw is reachable from an adjacent network and requires an admin-level account; it is triggered by sending a malicious VPN network profile config file containing special characters that the router fails to sanitize before passing to a system shell. Successful exploitation gives the attacker arbitrary command execution on the device with the privileges of the VPN profile handler. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Acer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network, such as a local LAN or VPN segment; remote over-the-internet exploitation is not possible with this vector.

• AuthenticationRequired

  An admin or privileged account is required to submit VPN profile config files, so the attacker must have already obtained high-privilege credentials.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker delivers the malicious config directly without any victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary operating system commands on the router with the privileges of the VPN profile processing component.
• All data transiting the device is accessible, including unencrypted LAN traffic and any credentials passed through the router.
• The attacker can modify persistent device configuration, including firewall rules, routing tables, and VPN credentials stored on the device.
• The router process can be crashed or rendered unresponsive, cutting off network connectivity for all clients dependent on the device.