The Acer Connect M6E 5G Portable WiFi Router encrypts data using AES-CBC mode with static zero-filled IVs. This cryptographic weakness (CWE-200) leads to exposure of sensitive information because the static IVs make the encryption vulnerable to replay attacks and known-plaintext decryption. The vulnerability is remotely exploitable without privileges or user interaction, with low complexity and low impact on confidentiality. No vendor advisory or patch information is currently available.

The vulnerability allows unauthorized actors to potentially decrypt sensitive data transmitted by the device due to the use of static zero-filled IVs in AES-CBC encryption. This can lead to exposure of confidential information through replay attacks or known-plaintext attacks. However, there is no indication of privilege escalation, integrity, or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the device to untrusted networks and monitor for vendor updates regarding patches or mitigations.