The Acer Connect M6E 5G Portable WiFi Router contains an IDOR vulnerability in its summary service endpoint. This endpoint fails to verify that the requesting user owns the hardware serial number being queried, enabling unauthorized users to access device data by manipulating the serial number parameter. This is a classic authorization bypass issue categorized under CWE-639. The vulnerability has a CVSS 4.0 score of 5.3, indicating a medium level of severity. No patch or official remediation has been disclosed by Acer, and the product is not a cloud service, so remediation depends on vendor action.

An attacker with at least low privileges can access device data associated with arbitrary hardware serial numbers without proper authorization. This could lead to unauthorized data disclosure or scraping of device information. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits are reported in the wild, limiting immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published, users should monitor Acer's advisories for updates. Until a patch is available, restricting access to the summary service endpoint or implementing network-level controls to limit unauthorized queries may reduce exposure.