This vulnerability (CVE-2026-49194) affects the Acer Connect M6E 5G Portable WiFi Router and is classified as CWE-287: Improper Authentication. The issue arises from a debugging routine SCREEN_CLICK(5053) that enables bypassing the device's login prompt, granting direct access to an interactive shell interface. This flaw allows an attacker with network access to the device to circumvent authentication controls, potentially leading to unauthorized device control. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements. No patch or official remediation level has been published by Acer as of the vulnerability's disclosure date.

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain direct interactive shell access to the device. This could lead to full compromise of the affected router, including unauthorized configuration changes, data interception, or disruption of service. Given the critical CVSS score of 9.4, the impact on confidentiality, integrity, and availability is high. However, there are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device management interface to trusted users only and monitor for any unusual activity. Avoid exposing the device management interface to untrusted networks. Follow Acer's official communications for updates on patches or mitigations.