This vulnerability (CVE-2026-49199) affects the Acer Predator Connect W6x device running firmware version W6x_GBL_2.00.000005. It is caused by improper handling of MQTT messages, which allows an attacker to perform command injection (CWE-77). Successful exploitation leads to root-level code execution without requiring authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, scope, and security requirements.

An attacker can achieve full root-level code execution on the vulnerable device remotely by sending crafted MQTT messages. This compromises the confidentiality, integrity, and availability of the device and potentially the network it is connected to. The severity is critical with a maximum CVSS score of 10. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor Acer's advisories closely. Until a patch is available, restricting network access to MQTT services on the device and applying network-level controls to limit exposure may reduce risk.