The vulnerability CVE-2026-49186 affects the Acer Connect M6E 5G Portable WiFi Router. It arises because the local MQTT broker fails to enforce topic-level ACLs, which means clients can subscribe to MQTT topics using wildcard characters (# or +) without proper authorization. This allows an attacker with local access to enumerate hidden devices on the network or publish unauthorized control commands to the router. The issue is categorized as an improper authentication vulnerability (CWE-287). The CVSS 4.0 base score is 8.6, indicating high severity. There is no vendor-provided patch or remediation information available, and no known exploits in the wild have been reported.

An attacker with local access to the MQTT broker can bypass topic-level access controls, enabling them to discover hidden network devices and send unauthorized commands to the router. This could lead to unauthorized control over network functions and potential disruption or compromise of network devices managed by the router.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local network access to trusted users and devices to reduce the risk of exploitation. Monitor for any updates from Acer regarding patches or mitigations for this vulnerability.