This vulnerability (CVE-2026-50206) involves improper neutralization of special elements used in OS commands (CWE-78) within the Acer Connect M6E 5G Portable WiFi Router. Specifically, the device fails to safely process special characters in incoming VPN network profile settings, enabling an attacker with high privileges to inject arbitrary OS commands via malicious configuration files. The CVSS 4.0 base score is 8.5, reflecting high impact and exploitability with network attack vector and low attack complexity. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with high privileges to execute arbitrary OS commands on the affected device by supplying malicious VPN profile configurations. This could lead to compromise of the router's operating system, potentially affecting device integrity and network security. The vulnerability does not require user interaction but does require the attacker to have high privileges on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor Acer's advisories for updates. Until a patch is available, restrict access to device configuration interfaces and avoid importing untrusted VPN profile files.