CVE-2026-49197 - Vulnerability Details - OpenCVE

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00041.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://community.acer.com/en/kb/articles/19672

History

Fri, 29 May 2026 12:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 29 May 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
Title		Predator Connect W6x: Improper Authentication
Weaknesses		CWE-287
References		https://community.acer.com/en/kb/articles/19672
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: Acer

Published: 2026-05-29T08:24:06.489Z

Updated: 2026-05-29T11:34:23.141Z

Reserved: 2026-05-28T02:47:39.776Z

Link: CVE-2026-49197

Vulnrichment

Updated: 2026-05-29T11:34:19.006Z

NVD

Status : Awaiting Analysis

Published: 2026-05-29T09:16:17.877

Modified: 2026-05-29T14:46:09.837

Link: CVE-2026-49197

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-29T10:30:41Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49197", "assignerOrgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "state": "PUBLISHED", "assignerShortName": "Acer", "dateReserved": "2026-05-28T02:47:39.776Z", "datePublished": "2026-05-29T08:24:06.489Z", "dateUpdated": "2026-05-29T11:34:23.141Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "shortName": "Acer", "dateUpdated": "2026-05-29T08:24:06.489Z"}, "title": "Predator Connect W6x: Improper Authentication", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "affected": [{"vendor": "Acer", "product": "Predator Connect W6x", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "W6x_GBL_2.00.000005", "lessThanOrEqual": "*", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails."}]}], "references": [{"url": "https://community.acer.com/en/kb/articles/19672"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 10, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "solutions": [{"lang": "en", "value": "Fixed on firmware version: W6x_GBL_2.00.000008.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Fixed on firmware version: W6x_GBL_2.00.000008."}]}], "credits": [{"lang": "en", "value": "rethesis", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-29T11:26:08.256495Z", "id": "CVE-2026-49197", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T11:34:23.141Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49197", "assignerOrgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "state": "PUBLISHED", "assignerShortName": "Acer", "dateReserved": "2026-05-28T02:47:39.776Z", "datePublished": "2026-05-29T08:24:06.489Z", "dateUpdated": "2026-05-29T11:34:23.141Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "shortName": "Acer", "dateUpdated": "2026-05-29T08:24:06.489Z"}, "title": "Predator Connect W6x: Improper Authentication", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "affected": [{"vendor": "Acer", "product": "Predator Connect W6x", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "W6x_GBL_2.00.000005", "lessThanOrEqual": "*", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails."}]}], "references": [{"url": "https://community.acer.com/en/kb/articles/19672"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 10, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "solutions": [{"lang": "en", "value": "Fixed on firmware version: W6x_GBL_2.00.000008.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Fixed on firmware version: W6x_GBL_2.00.000008."}]}], "credits": [{"lang": "en", "value": "rethesis", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T11:26:08.256495Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T11:34:19.006Z"}}]}}