This vulnerability in the Acer Connect M6E 5G Portable WiFi Router involves improper authentication controls that permit unauthorized access to internal multimedia session archives. Additionally, the router's loose CORS configuration facilitates cross-origin attacks, potentially allowing malicious websites to steal sensitive data from the device. The CVSS 4.0 base score is 8.8, indicating a high impact with network attack vector, no privileges or user interaction required, and high confidentiality impact. No patch or official remediation has been disclosed by Acer as of the publication date.

Unauthorized parties can access sensitive multimedia session archives stored internally on the device without authentication. The permissive CORS settings increase the risk by enabling cross-site theft of this data. This can lead to significant confidentiality breaches. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the device to untrusted networks and disabling any remote management features if possible. Monitor vendor communications for updates on patches or configuration changes that address the issue.