CVE-2026-49196 Predator Connect W6x: Web Interface Command Injection

High 8.6 Published 29 May 2026 Updated 29 May 2026

Attackers can execute arbitrary shell commands via unsanitized MAC address input in the Wi-Fi blocking feature of Predator Connect W6x devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-49196?

CVE-2026-49196 is a high-severity command injection vulnerability in Acer Predator Connect W6x, published on 29 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.

Weakness: CWE-77

Which versions are affected by CVE-2026-49196?

It affects 1 product.

Products include Acer Predator Connect W6x Firmware.

How do I fix CVE-2026-49196?

No fix has been published for CVE-2026-49196 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-49196 being exploited?

There is no known exploitation of CVE-2026-49196 in the wild and no public exploit code.

Sources

Also known as GHSA-68jv-x4hh-mmjq.