This vulnerability (CVE-2026-49203) affects the Acer Connect M6E 5G Portable WiFi Router. It involves improper authentication (CWE-287) in management API endpoints responsible for cellular eSIM allocation. Because these endpoints do not validate the caller's authorization, an attacker with network access can remotely rewrite or delete eSIM profiles on the device. The CVSS 4.0 vector indicates the attack requires adjacent network access (AV:A), has low attack complexity (AC:L), no privileges or user interaction needed (PR:N, UI:N), and results in high impact on integrity and availability (VI:H, VA:H). No patch or official remediation details have been provided by Acer as of the publication date.

Successful exploitation allows an attacker to remotely modify or delete cellular eSIM profiles on the affected device without authentication. This can disrupt cellular connectivity and potentially cause denial of service or unauthorized profile manipulation. The impact on confidentiality is low, but integrity and availability impacts are high. The attack requires adjacent network access, limiting exposure to local or network-adjacent attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interfaces to trusted users only. Monitor for unusual changes to eSIM profiles and consider network segmentation to limit exposure. Follow Acer's official communications for updates on patches or mitigations.