The vulnerability is an improper access control flaw in the MQTT broker of Acer Predator Connect W6x. It allows wildcard topic subscriptions, enabling unauthorized actors to observe or inject any MQTT messages. The weakness is a classic authorization error, classified as CWE-284, and can lead to significant confidentiality and integrity compromises when the broker is exposed to external networks.

The affected product is the Acer Predator Connect W6x. Devices with firmware versions prior to the fixed release W6x_GBL_2.00.000008 are vulnerable, while later firmware includes the patch.

The CVSS score of 8.3 rates this flaw as high severity, indicating that exploitation could have a wide impact. Although the EPSS score is not available, the lack of a published KEV status suggests no publicly confirmed exploits yet. Based on the MQTT broker context, the likely attack vector is remote network access, where an attacker could connect to the broker and subscribe to the wildcard topic, thereby harvesting all message traffic.