The vulnerability identified as CVE-2026-49188 affects the Acer Connect M6E 5G Portable WiFi Router. It involves the ai_cmd utility, which executes with full root permissions and directly pipes socket inputs to the popen() function. This design flaw enables unauthenticated attackers to execute arbitrary commands with root privileges on the device. The CVSS 4.0 vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, resulting in high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows unauthenticated attackers on the adjacent network to execute arbitrary commands with root privileges on the affected device. This can lead to full compromise of the router, including control over device configuration, data interception, and disruption of service. The vulnerability has a high CVSS score of 8.7 reflecting its severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's management interfaces to trusted networks only and monitor for suspicious activity. Avoid exposing the device to untrusted networks.