This vulnerability (CWE-22) in the Acer Connect M6E 5G Portable WiFi Router involves improper limitation of pathname to a restricted directory, specifically through unverified pass-through AT commands accepted by the system Binder boundary. This flaw enables local applications with limited privileges to access sensitive baseband files or disrupt cellular connectivity. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been documented by the vendor.

Exploitation of this vulnerability could allow a local attacker to read sensitive baseband files, potentially exposing confidential information, or to disable cellular connectivity on the device, impacting availability. Given the high CVSS score and the nature of the impact, this could significantly affect device functionality and security. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local application access to the system Binder interface and monitor for unauthorized use of AT commands. Avoid running untrusted applications with local privileges that could exploit this vulnerability.