This vulnerability (CVE-2026-50208) affects the Acer Connect M6E 5G Portable WiFi Router and is categorized under CWE-330 for the use of insufficiently random values. The device disables standard TLS certificate validation via TrustAllCerts routines and relies on hard-coded DES encryption keys. These weaknesses could enable an attacker performing a Man-in-the-Middle attack to decrypt network traffic, compromising confidentiality. The CVSS 4.0 vector indicates network attack vector with high impact on confidentiality and integrity, but requires high attack complexity and no privileges or user interaction. No patch or official remediation level has been disclosed by Acer, and the device is not a cloud service, so remediation depends on vendor updates or device replacement.

The vulnerability allows a remote attacker to potentially decrypt network traffic by exploiting disabled TLS certificate validation and hard-coded encryption keys. This compromises the confidentiality and integrity of communications through the affected WiFi router. Given the critical CVSS score of 9.2, successful exploitation could lead to significant data exposure. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by Acer, users should monitor for vendor updates. Until a patch is available, consider limiting exposure by restricting device network access or replacing the device with a more secure alternative. Avoid relying on the affected router for sensitive communications.