The vulnerability resides in the /sbin/mtk_dut binary which is exposed on TCP port 9000 by lack of authentication checks. An attacker on the local network can open a connection to this port and send arbitrary UCC commands, effectively giving them the ability to execute arbitrary code on the device. This is a classic missing authentication flaw (CWE‑306) that permits remote code execution without any need for user credentials.

Affected units are Acer Predator Connect W6x models running firmware versions prior to W6x_GBL_2.00.000008. The official fix is provided by the vendor as firmware update W6x_GBL_2.00.000008.

The CVSS score of 8.7 indicates serious severity, while the EPSS is not available, suggesting no data on likely exploitation but still high risk. Because the service is reachable over a LAN port without authentication, an attacker can directly launch the exploit from within the internal network, making this a high threat even for devices that are not publicly exposed. The vulnerability is not listed in the CISA KEV catalog.