The vulnerability CVE-2026-49194 in the Acer Connect M6E 5G Portable WiFi Router involves an improper authentication flaw (CWE-287) where a debugging routine SCREEN_CLICK(5053) enables an attacker to bypass the normal login process and gain direct access to an interactive shell interface on the device. This bypass compromises device security by allowing unauthorized access to potentially sensitive functions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, scope, and security requirements. The vendor has not provided a patch or remediation level, and no affected versions are specified.

Successful exploitation allows an attacker to bypass authentication controls and gain direct shell access to the device. This can lead to unauthorized control over the router, potentially compromising confidentiality, integrity, and availability of the device and network traffic. Given the interactive shell access, attackers could execute arbitrary commands, modify configurations, or disrupt device operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical and network access to the device to trusted users only. Monitor for unusual activity and consider disabling debugging features if possible. Avoid exposing the device management interface to untrusted networks.