This vulnerability involves the /v1/Plan service of the Acer Connect M6E 5G Portable WiFi Router relying solely on a shared global API token for administrative management. Because this token grants full administrative privileges without additional verification, an attacker can exploit it to create network access plans that cost nothing, bypassing intended controls. The weakness is classified under CWE-345, indicating insufficient verification of data authenticity. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to gain full administrative control over the /v1/Plan service, enabling arbitrary creation of zero-cost network access plans. This can lead to unauthorized free network access, potentially causing financial loss and service abuse. The vulnerability severely compromises confidentiality, integrity, and availability of the affected device's network management functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /v1/Plan service and avoid exposing the device management interfaces to untrusted networks. Monitor for updates from Acer regarding patches or official mitigations.