This vulnerability (CVE-2026-49187) affects the Acer Connect M6E 5G Portable WiFi Router and is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The root cause is that certain hard-coded APK resource files do not expire, combined with a shared scepter that enables unauthorized information disclosure. The vulnerability allows an attacker with network access to obtain sensitive information without requiring privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No official patch or vendor remediation guidance is currently available.

The vulnerability can lead to unauthorized disclosure of sensitive information from the affected router due to non-expiring hard-coded resources and shared scepter misuse. This exposure could facilitate further attacks or misuse of the device's data. The CVSS score of 8.7 reflects a high impact on confidentiality with no required privileges or user interaction, making it a serious concern for device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided by Acer, users should monitor for vendor updates. Until a fix is available, limiting network exposure of the device and restricting access to trusted users may reduce risk.