The vulnerability CVE-2026-50206 affects the Acer Connect M6E 5G Portable WiFi Router. It arises because the device fails to safely process special characters in incoming VPN network profile settings. This improper neutralization leads to OS command injection (CWE-78), enabling an attacker with high privileges to execute arbitrary commands on the device. The CVSS 4.0 base score is 8.5, reflecting high impact and relatively low attack complexity, but requiring high privileges and no user interaction. No patch or official remediation guidance has been published by Acer as of the vulnerability disclosure date.

Successful exploitation allows an attacker with high privileges to execute arbitrary OS commands on the affected router by injecting malicious commands via VPN profile configuration files. This can lead to compromise of the device's integrity and potentially affect network operations. The vulnerability does not require user interaction but does require elevated privileges, limiting the attack surface to privileged users or processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's configuration interfaces to trusted administrators only and validate VPN profile files before deployment to prevent injection of malicious commands.