This vulnerability (CVE-2026-49189) affects the Acer Connect M6E 5G Portable WiFi Router and is classified under CWE-269 (Improper Privilege Management). The issue arises because a core Broadcast Receiver component has public access permissions that are not properly checked, enabling unauthorized local software to perform administrative operations. The CVSS 4.0 base score is 8.5, indicating high severity, with local attack vector, low complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is not related to cloud services, and no known exploits are reported in the wild. No patch or remediation level has been disclosed by the vendor as of the publication date.

The vulnerability allows unauthorized local software components to invoke administrative operations on the affected device, potentially leading to unauthorized control or configuration changes. The high CVSS score reflects significant impact on confidentiality, integrity, and availability of the device. Since the attack vector is local, an attacker would need local access to exploit this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users and devices to reduce the risk of exploitation. Monitor for vendor updates regarding patches or official mitigations.