CVE-2026-49195: MTK Debug Service RCE Vulnerability

CVE-2026-49195 Overview

CVE-2026-49195 is an unauthenticated debug service vulnerability affecting an Acer device. The /sbin/mtk_dut binary listens on TCP port 9000 without any authentication. Any attacker on the local network can connect to the service and execute arbitrary UCC (Unified Configuration Command) commands. The flaw is categorized as Missing Authentication for Critical Function [CWE-306]. Acer published technical details in their community knowledge base.

Critical Impact
An adjacent network attacker can issue arbitrary UCC commands to the affected device without credentials, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Acer device exposing the /sbin/mtk_dut debug binary
Devices listening on TCP port 9000 without authentication
Refer to the Acer Community Article for the affected models and firmware list

Discovery Timeline

2026-05-29 - CVE-2026-49195 published to the National Vulnerability Database (NVD)
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-49195

Vulnerability Analysis

The /sbin/mtk_dut process is a MediaTek device-under-test (DUT) helper binary commonly used during manufacturing and engineering validation. On affected Acer devices, this binary remains active in production firmware and binds to TCP port 9000 on the LAN interface. The service accepts UCC commands from any client that can reach the port.

Because the service performs no authentication and no source validation, an attacker on the same Layer 2 segment can issue commands directly. UCC commands provide low-level control over device configuration, radio parameters, and diagnostic functions. Successful command execution yields high impact to confidentiality, integrity, and availability of the device.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. A debug interface intended for factory testing was left enabled and network-accessible in shipping firmware. The service does not require a credential, token, or signed command to process UCC requests.

Attack Vector

Exploitation requires adjacency to the target network. An attacker connected to the LAN, including over Wi-Fi, opens a TCP socket to port 9000 on the device. The attacker then writes UCC commands to the socket and reads responses. No user interaction is required, and no prior privileges on the device are needed. See the Acer Community Article for vendor-supplied technical details.

Detection Methods for CVE-2026-49195

Indicators of Compromise

Unexpected inbound TCP connections to port 9000 on the LAN interface of Acer devices
Presence of a listening /sbin/mtk_dut process on production firmware
UCC command traffic patterns originating from non-administrative LAN hosts
Unauthorized configuration changes to radio, network, or diagnostic settings

Detection Strategies

Scan internal network segments for hosts listening on TCP port 9000 and fingerprint banners associated with mtk_dut
Inspect device process listings during firmware audits to confirm whether mtk_dut is running in production builds
Apply network IDS signatures that flag UCC command syntax traversing the LAN to port 9000

Monitoring Recommendations

Log and alert on new TCP/9000 listeners appearing on managed network equipment
Monitor LAN flow records for unsolicited client-to-router connections on non-standard administrative ports
Track configuration drift on Acer devices and correlate against authorized change windows

How to Mitigate CVE-2026-49195

Immediate Actions Required

Restrict LAN access to affected Acer devices to trusted administrative hosts only
Block TCP port 9000 at network boundaries and on host firewalls where supported
Segment guest and IoT Wi-Fi networks from devices exposing the mtk_dut service
Review the Acer Community Article and apply vendor-recommended firmware updates as they become available

Patch Information

Acer documents the issue in their knowledge base. Administrators should consult the Acer Community Article for affected models, firmware versions, and the current remediation status. Apply the latest firmware release that disables or authenticates the mtk_dut service.

Workarounds

Disable Wi-Fi access for untrusted users to remove adjacent-network exploitation paths
Place affected devices behind a managed switch ACL that drops traffic to TCP port 9000
Where the device supports it, disable engineering or factory test modes through the administrative interface

bash

# Example: block LAN access to TCP/9000 on an upstream Linux gateway
iptables -A FORWARD -p tcp --dport 9000 -d <acer_device_ip> -j DROP
iptables -A INPUT   -p tcp --dport 9000 -j DROP