CVE-2026-49198

MediumCVSS 4.9/10Last modified Jul 21, 2026

Description

Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
AcerPredator Connect W6x>= W6x_GBL_2.00.000005, <= *

References

Timeline

Published
May 29, 2026
Last modified
Jul 21, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-491999.8Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.CVE-2026-49206.4The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to,CVE-2026-492009.8The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login CVE-2026-492019.8The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypCVE-2026-492028.6Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules CVE-2026-492038.3Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewrittenCVE-2026-492046.5Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.CVE-2026-492056.5phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-CVE-2026-492062.9rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t iCVE-2026-492085.3Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LiveProp] is typed as DateTimeInterface and noCVE-2026-492096.5Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionControllCVE-2026-49212.7IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message
CVE-2026-49198: Medium severity, CVSS 4.9 | Vulnix