This vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78) within the Acer Connect M6E 5G Portable WiFi Router. The system does not correctly enforce permission checks over multiple internal operation codes, enabling attackers with limited privileges to execute unauthorized commands or install applications. The CVSS 4.0 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation can lead to unauthorized command execution or application installation on the affected device, potentially compromising device integrity, confidentiality, and availability. Given the critical CVSS score and the nature of the vulnerability, attackers could gain significant control over the device without user interaction or elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by Acer at this time. Users and administrators should monitor Acer's advisories for updates and apply patches promptly once available.