CVE-2026-50206: Acer Connect M6E 5G VPN Profile Command Injection Vulnerability

Technical summary

CVE-2026-50206 is an OS command injection vulnerability (CWE-78) in the VPN network profile import functionality of Acer Connect M6E 5G devices. The affected firmware does not implement proper input validation or escaping when processing special characters within VPN configuration files. An attacker with administrator-level privileges can craft a malicious VPN profile that includes shell metacharacters or command separators in configuration fields. When the device processes this file, the unsanitized input is passed to an underlying command execution context, enabling arbitrary command execution with device privileges. The CVSS 3.1 score of 6.8 (MEDIUM) reflects the requirement for high administrative privilege to trigger the vulnerability, balanced against its high impact on confidentiality, integrity, and availability once exploited.

Business impact

Compromise of an Acer Connect M6E 5G device via this vulnerability could allow an attacker to gain full control over the device's network functionality, intercept or redirect traffic, disable connectivity, or use the device as a pivot point to attack downstream networks. For organizations deploying these devices as mobile hotspots or edge network appliances, a successful attack could disrupt business continuity, compromise sensitive data in transit, and create regulatory compliance issues. The risk is particularly acute if device management accounts are shared, poorly secured, or compromised through phishing or credential stuffing. Rapid patching is essential for any device deployed in sensitive network environments.

Affected systems

The vulnerability affects Acer Connect M6E 5G devices running vulnerable firmware versions. The exact firmware versions requiring patching should be verified against Acer's official security advisory. Both the device hardware (acer connect_m6e_5g) and its associated firmware package (acer connect_m6e_5g_firmware) are in scope. Organizations should inventory all instances of this device model and determine current firmware versions to assess exposure.

Exploitability

Exploitation requires administrator-level access to the device's management interface, which significantly raises the bar for opportunistic attacks. However, the vulnerability is straightforward to exploit once authenticated—an attacker simply needs to craft a VPN profile file with injected commands and upload it through the configuration menu. No user interaction is required beyond the initial authentication. The low attack complexity and absence of any race conditions make this a reliable attack vector for inside threats or attackers with compromised administrative credentials. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but this does not diminish the urgency of patching in high-risk environments.

Remediation

Apply the latest firmware patch released by Acer for the Connect M6E 5G model. Verify the patch version against Acer's security advisory to ensure you are installing a build that specifically addresses CVE-2026-50206. Additionally, implement access controls to restrict VPN profile upload functionality to a minimal set of trusted administrators, enable logging and monitoring of configuration changes, and consider air-gapping or network-segmenting these devices if they are not essential to day-to-day operations. Review administrative credential hygiene to reduce the likelihood of account compromise.

Patch guidance

Check Acer's support portal for the Connect M6E 5G and download the latest available firmware. Before deploying patches, test them in a non-production environment to verify compatibility with your network configuration and any custom VPN profiles. Schedule patching during a maintenance window to minimize network disruption. After patching, verify that VPN functionality remains operational and that no previously uploaded malicious profiles persist. Document the patch version applied for compliance and audit purposes.

Detection guidance

Monitor device logs for unusual VPN profile uploads or configuration changes, particularly outside normal maintenance windows. Alert on any configuration import events from unexpected IP addresses or at atypical times. If device logs are accessible, search for shell metacharacters (pipes, semicolons, backticks, dollar signs) in VPN profile field values. Network-based detection is difficult without deep packet inspection of configuration file uploads. Organizations with SIEM systems should correlate any device reboots or command execution anomalies with recent configuration changes. Establish a baseline of normal administrative behavior to identify deviations.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score and requires administrative authentication, it enables complete device compromise and should be treated as high priority in any environment where the Connect M6E 5G is deployed in a trust boundary with sensitive data or critical network paths. The simplicity of exploitation and the broad impact on device integrity and availability justify prompt remediation. Organizations with deployed instances should treat this as a critical patching candidate.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects a medium overall risk profile tempered by the high-privilege requirement (PR:H), but weighted against the high impact across all three security dimensions (confidentiality, integrity, availability). The attack vector is Adjacent Network (AV:A), meaning an attacker must have network access to the device but does not need to be on the Internet backbone. The low attack complexity (AC:L) and absence of user interaction (UI:N) indicate that once an attacker has administrative credentials, exploitation is trivial. The score appropriately penalizes the privilege requirement but does not discount the severity of impact, making this a vulnerability that should not be ignored despite its medium label.

Frequently asked questions