This vulnerability (CVE-2026-50209) in the Acer Connect M6E 5G Portable WiFi Router is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). It allows malicious software to leverage broadcast events to change the device's default MDM endpoint address. By doing so, an attacker can shift administrative ownership of the device to themselves, potentially gaining full control. The CVSS 4.0 vector indicates the attack requires local access with low complexity and no user interaction, but results in high confidentiality, integrity, availability, and security scope impacts. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with local access to rewrite the MDM endpoint address, effectively transferring administrative control of the device to the attacker. This compromises device management, potentially enabling persistent unauthorized control, configuration changes, and data interception or manipulation. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to the device to trusted users only and monitor for unusual configuration changes. Avoid exposing the device to untrusted networks or users. Follow up with Acer for any forthcoming security updates or advisories.