Predator Connect W6x CVEs and Security Vulnerabilities

CVE-2026-49198

Predator Connect W6x: MQTT Broker Access Control

Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Acer

Products

Predator Connect W6x Predator Connect W6x Firmware

CVE-2026-49197

Predator Connect W6x: Improper Authentication

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Acer

Products

Predator Connect W6x Predator Connect W6x Firmware

CVE-2026-49196

Predator Connect W6x: Web Interface Command Injection

The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Acer

Products

Predator Connect W6x Predator Connect W6x Firmware

CVE-2026-49195

Predator Connect W6x: unauthenticated Debug Service

Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Acer

Products

Predator Connect W6x Predator Connect W6x Firmware

CVE-2026-49199

Predator Connect W6x: RCE via MQTT

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

CVSS 4.0 · 10 Critical EPSS 1.3% KEV · Not listed

Vendors

Acer

Products

Predator Connect W6x Predator Connect W6x Firmware

Search vulnerabilities

Predator Connect W6x: MQTT Broker Access Control

Predator Connect W6x: Improper Authentication

Predator Connect W6x: Web Interface Command Injection

Predator Connect W6x: unauthenticated Debug Service

Predator Connect W6x: RCE via MQTT