This vulnerability (CVE-2026-49204) arises from leftover debug modules in the Acer Connect M6E 5G Portable WiFi Router that include hard-coded credentials for internal AWS Cognito test sandboxes. These fixed credentials could allow unauthorized access to internal assets if exploited. The vulnerability is remotely exploitable without authentication or user interaction, with low attack complexity. The product is cloud-hosted, and the vendor manages remediation for the cloud service. The CVSS 4.0 score is 6.9 (medium severity).

The presence of hard-coded credentials in debug modules risks unauthorized access to internal AWS Cognito test sandboxes, potentially exposing internal assets. The vulnerability can be exploited remotely without privileges or user interaction, which increases risk. However, no known exploits have been reported in the wild. The impact is limited to the exposure of internal test environments rather than production systems.

A patch is available for this vulnerability. Since the affected product is a cloud service, the vendor (Acer) manages remediation server-side. Security teams should verify with Acer's official advisory or support channels that the patch has been applied and the debug modules with hard-coded credentials have been removed. No additional mitigation actions are indicated at this time.