Crafted MQTT messages can trigger command injection, allowing an attacker to execute arbitrary commands as the system user. This results in full root-level code execution on the target device, compromising the confidentiality, integrity, and availability of the system. The weakness is a classic command injection vulnerability identified as CWE‑77.

Acer Predator Connect W6x wireless routers are impacted. No explicit affected firmware versions are listed, but the vendor has issued a fix in firmware version W6x_GBL_2.00.000008. Devices running earlier firmware are potentially vulnerable.

The CVSS score of 10 indicates a severe risk. The EPSS score of 2% indicates a low but non-zero probability of exploitation; however, the exploit requires only the ability to send MQTT messages to the device, which is a standard network-facing interface. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no known active exploits, but the remote attack vector and high CVSS score make it a critical risk.