The Acer Connect M6E 5G Portable WiFi Router improperly implements AES-CBC encryption by using static zero-filled Initialization Vectors (IVs). This cryptographic flaw allows attackers to perform replay attacks and potentially decrypt known plaintext data, leading to unauthorized exposure of sensitive information (CWE-200). The vulnerability is publicly documented as CVE-2026-50210 with a CVSS 4.0 score of 6.9 (medium severity). No patch or official fix has been disclosed by Acer, and no exploits are known to be active in the wild.

Sensitive information transmitted or stored by the affected device may be exposed to unauthorized actors due to weak encryption practices. The use of static zero IVs in AES-CBC mode compromises the confidentiality of data, enabling replay attacks and known-plaintext decryption. This can lead to information disclosure but does not indicate privilege escalation or denial of service. The impact is limited to confidentiality breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available from Acer, users should monitor for firmware updates addressing this issue. Until a fix is released, consider limiting sensitive data transmission through the device or using additional encryption layers where possible.