The vulnerability identified as CVE-2026-49185 affects the Acer Connect M6E 5G Portable WiFi Router. It is caused by improper neutralization of special elements used in OS commands (CWE-78). Specifically, the FieldX MDM adb messaging topic forwards unverified payloads directly into the Runtime.exec() function, enabling OS command injection. This allows an unauthenticated attacker to execute arbitrary commands on the device with no required privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No vendor patch or mitigation has been disclosed as of the published date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device. This can lead to full compromise of the device, including unauthorized access, data manipulation, disruption of service, or further network penetration. Given the critical CVSS score of 10, the impact on confidentiality, integrity, and availability is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided by Acer at this time. Until a patch is available, restrict network access to the affected device and monitor for suspicious activity related to the FieldX MDM adb messaging topic.