This vulnerability (CVE-2026-49198) in the Acer Predator Connect W6x MQTT broker arises from improper access control (CWE-284). It permits unauthorized users with low privileges to subscribe to wildcard MQTT topics, thereby gaining access to all MQTT traffic. The CVSS 4.0 base score is 8.3, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality and security capabilities. The affected version is W6x_GBL_2.00.000005. No patch or official remediation is currently documented.

Successful exploitation allows unauthorized actors to access all MQTT traffic on the affected device, potentially exposing sensitive data transmitted via MQTT. The vulnerability compromises confidentiality and security capabilities but does not affect integrity or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor Acer's advisories for updates. Until a patch is available, restricting network access to the MQTT broker and limiting exposure to untrusted networks may reduce risk.