Auth bypass in Acer Predator Connect W6x

CVE-2026-49195

Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker to execute arbitrary UCC commands.

Vulnerability class: Broken Authentication

EPSS: 0.000 (6.7th percentile) — read the EPSS interpretation.