This vulnerability involves improper authentication (CWE-287) in the Acer Connect M6E 5G Portable WiFi Router. The root cause is the hard-coding of backend API keys within the M3WebServer production build. These keys are exposed through verbose error handling pages, making it possible for an attacker to intercept them and bypass authentication mechanisms. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. There is no indication of a patch or vendor advisory specifying remediation status.

If exploited, this vulnerability could allow an unauthenticated attacker to gain unauthorized access to backend APIs by intercepting hard-coded API keys exposed through error pages. This could lead to compromise of sensitive data, unauthorized control over router functions, and disruption of service. The critical CVSS score reflects the potential for significant confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit exposure of the device to untrusted networks and monitor for any updates from Acer regarding patches or mitigations. Avoid exposing the device management interface to the internet or untrusted environments.