This vulnerability (CVE-2026-50211) affects the Acer Connect M6E 5G Portable WiFi Router due to leftover engineering and factory diagnostic software present on retail firmware builds. These diagnostics expose internal NVRAM registers with write privileges to malicious applications. The issue is categorized as CWE-134, which involves the use of externally-controlled format strings, a common source of format string vulnerabilities. The CVSS 4.0 base score is 8.8, reflecting a high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Malicious applications can exploit this vulnerability to write to internal NVRAM registers on the affected device, potentially compromising device configuration, stability, or security. The high CVSS score indicates significant impact on confidentiality and availability. Since the vulnerability allows unauthorized write access without privileges or user interaction, it poses a serious risk to device integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by Acer at this time. Until a patch is available, users should exercise caution with applications installed on the device and monitor for vendor updates.