This vulnerability (CVE-2026-49204) arises from the presence of hard-coded credentials embedded in leftover debug modules within the Acer Connect M6E 5G Portable WiFi Router environment. These credentials provide access to internal AWS Cognito test sandboxes, creating a risk of asset exploitation. The vulnerability is remotely exploitable without authentication or user interaction, with low complexity. The product is a cloud service, and the vendor is responsible for patching and remediation. No known exploits are reported in the wild.

The exposure of hard-coded credentials for internal AWS Cognito test sandboxes could allow an attacker to access internal assets related to the cloud service of the Connect M6E 5G Portable WiFi Router. This may lead to unauthorized access and potential compromise of internal resources. However, there are no reported active exploits in the wild at this time.

A patch is available for this vulnerability. Since the affected product is a cloud service, Acer manages the remediation server-side. Users should verify with Acer's official advisory for confirmation and ensure their service is updated accordingly. No additional user action is required beyond applying the vendor's patch or update.