The Acer Connect M6E 5G Portable WiFi Router contains an IDOR vulnerability (CWE-639) in its summary service endpoint. This endpoint fails to verify that the requesting user owns the hardware serial number they query, enabling unauthorized users to access device data by manipulating the serial number parameter. The vulnerability has a CVSS 4.0 score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available to confirm remediation status.

Unauthorized users can access device data associated with hardware serial numbers they do not own. This exposure could lead to data scraping and potential privacy concerns. The impact is limited to unauthorized data disclosure without evidence of further privilege escalation or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the summary service endpoint where possible and monitor for unusual access patterns related to hardware serial number queries.