The vulnerability identified as CVE-2026-49190 affects the Acer Connect M6E 5G Portable WiFi Router. It involves improper neutralization of special elements used in OS commands (CWE-78), specifically due to failure in evaluating instructional permissions over multiple internal operation codes (opcodes). This flaw permits unauthorized installation of applications or execution of arbitrary commands on the device. The CVSS 4.0 base score is 9.4, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements. No patch or official remediation level has been published by Acer as of the vulnerability publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary OS commands or install unauthorized applications on the affected router. This can lead to full compromise of the device, potentially impacting confidentiality, integrity, and availability of the network traffic and connected devices. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by Acer, users should monitor for vendor updates. Until a patch is available, restricting network access to the device and limiting exposure to untrusted networks may reduce risk.