Access Control Flaw in Local MQTT Broker Affects Acer Products

CVE-2026-49186

What is CVE-2026-49186?

A significant access control vulnerability exists in Acer's local MQTT broker, which fails to enforce topic-level Access Control Lists (ACLs). This oversight permits any client to utilize wildcard characters (such as # or +) to access restricted network devices or issue unauthorized commands. As a result, attackers could potentially enumerate sensitive network devices or disrupt normal functionality by executing malicious control commands.

References