The vulnerability identified as CVE-2026-50224 affects the Acer Connect M6E 5G Portable WiFi Router. The web administration panel listens on the public IPv6 address space on port 8080 without firewall limitations, which makes internal API endpoints accessible from outside the local network. This exposure constitutes an information disclosure issue categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 4.0 base score is 6.9, indicating medium severity. No patch or official remediation guidance has been provided by the vendor at this time.

The exposure of internal API endpoints over the WAN can lead to unauthorized access to sensitive information managed by the router's administration panel. Although no direct exploit in the wild is known, the vulnerability could allow attackers with network access to gather sensitive data, potentially compromising device security or user privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting IPv6 access to the router's administration interface by implementing firewall rules or disabling remote administration over IPv6 if possible.