CVE-2026-49199

The attacker sends a crafted MQTT message whose content is not properly validated or sanitized by the target device. Improper handling of input data leads to injection and execution of arbitrary system commands (command injection, CWE-77). The exploit does not require any user interaction or account possession on the device — network access to the MQTT service is sufficient.

The attacker obtains remote code execution (RCE) with root privileges, which means full control over the device, ability to modify configuration, steal data, and potential use of the device as an entry point for further actions on the network.

Apply patches available from the manufacturer according to the references (https://community.acer.com/en/kb/articles/19672). Until the update is applied, it is recommended to restrict network access to the MQTT service on vulnerable devices through a firewall or network segmentation.

Versions indicated in the manufacturer's references (Acer); specific models and software versions were not mentioned in the CVE description