This vulnerability (CVE-2026-49189) affects the Acer Connect M6E 5G Portable WiFi Router and stems from improper privilege management (CWE-269). Specifically, a core Broadcast Receiver component has unchecked public access permissions, enabling unauthorized local software components to perform administrative operations. The CVSS 4.0 vector indicates the attack requires local access with low complexity and privileges, no user interaction, and results in high confidentiality, integrity, and availability impacts. No patch or official remediation level has been disclosed by the vendor.

If exploited, unauthorized local software can invoke administrative operations on the affected router, potentially compromising device confidentiality, integrity, and availability. This could lead to unauthorized configuration changes or control over the device. However, exploitation requires local access and low privileges, which somewhat limits the attack surface. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users and software only. Monitor for vendor updates regarding patches or official mitigations.