CVE-2026-49197

CriticalCVSS 9.8/10Last modified Jul 21, 2026

Description

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Acer	Predator Connect W6x	>= W6x_GBL_2.00.000005, <= *

References

https://community.acer.com/en/kb/articles/19672Vendor Advisory

Timeline

Published: May 29, 2026
Last modified: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-491984.9Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.CVE-2026-491999.8Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.CVE-2026-49206.4The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to,CVE-2026-492009.8The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login CVE-2026-492019.8The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decryp CVE-2026-492028.6Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules CVE-2026-492038.3Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten CVE-2026-492046.5Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.CVE-2026-492056.5phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-CVE-2026-492062.9rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t i CVE-2026-492085.3Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and no CVE-2026-492096.5Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionControll