CVE-2026-50206 VPN Command Injection Vulnerability
Attackers can execute arbitrary commands on Acer Connect M6E routers by submitting malicious VPN configuration files with unsafe special characters.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50206?
CVE-2026-50206 is a high-severity command injection vulnerability in Acer Connect M6E 5G Portable WiFi Router, published on 4 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.
Weakness: CWE-78
Which versions are affected by CVE-2026-50206?
It affects 1 product.
Products include Acer Connect M6e 5g Firmware.
How do I fix CVE-2026-50206?
No fix has been published for CVE-2026-50206 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-50206 being exploited?
There is no known exploitation of CVE-2026-50206 in the wild and no public exploit code.
Other vulnerabilities in Acer Connect M6E 5G Portable WiFi Router
Sources
Also known as GHSA-vhmh-w6ph-mvx3.