CVE-2026-49203 is an improper authentication vulnerability (CWE-287) in the Acer Connect M6E 5G Portable WiFi Router. The issue arises because critical management API endpoints responsible for cellular eSIM allocation fail to validate the authorization of the caller. This flaw allows remote attackers to rewrite or delete eSIM profiles on the device without authentication, potentially disrupting cellular connectivity or causing denial of service. The vulnerability has a CVSS 4.0 base score of 7.2, indicating high severity, with attack vector being adjacent network, low attack complexity, no privileges required, and no user interaction needed.

Exploitation of this vulnerability allows unauthorized remote attackers to modify or delete cellular eSIM profiles on the affected router. This can result in loss of cellular connectivity or denial of service for legitimate users relying on the eSIM functionality. The vulnerability does not require privileges or user interaction, increasing the risk of exploitation in adjacent network environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by Acer at this time. Users and administrators should monitor Acer's advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restricting network access to the management API endpoints may reduce exposure.