This vulnerability (CVE-2026-50213) in the Acer Connect M6E 5G Portable WiFi Router is classified under CWE-798 (Use of Hard-coded Credentials). The affected endpoint /v1/User/validate exposes comprehensive user profile data sheets that can be accessed by iterating through predictable user IDs. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

An attacker can access detailed user profile information without authentication by exploiting the predictable identification strings at the /v1/User/validate endpoint. This compromises user confidentiality and potentially exposes sensitive data. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for unusual access patterns. Avoid exposing the device management interface to untrusted networks.