Incoming VPN network profile settings in the Acer Connect M6E 5G Portable WiFi Router do not handle special characters safely, allowing an attacker to inject arbitrary commands through malicious configuration files. This weakness, classified as CWE‑78, could enable the execution of any command with the privileges of the router, leading to full compromise of the device.

The vulnerability affects the Acer Connect M6E 5G Portable WiFi Router. No specific firmware revisions are listed, so all current releases of this model are potentially impacted unless a later firmware patch has been issued.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, so the probability of exploitation remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. The text does not explicitly state the attack vector, but it is inferred that an attacker would have to supply a crafted VPN profile file to the router, which could be achieved by authorized administrative access or by intercepting VPN traffic in environments where unauthorized configuration changes are possible. Once a malicious profile is applied, the attacker can run arbitrary commands on the device.