Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.
The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.
Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.
CVE-2026-50206 is a high-severity OS command injection vulnerability in the Acer Connect M6E 5G Portable WiFi Router. The issue arises because incoming VPN network profile settings do not properly neutralize special characters, allowing maliciously crafted configuration files to inject OS commands. This vulnerability requires high privileges to exploit and does not involve user interaction. No official patch or remediation guidance is currently available from the vendor.
Acer Connect M6E 5G Portable WiFi Router logs sensitive information including unencrypted SMTP server authentication passwords and employee corporate identification data in system log files. This vulnerability can lead to exposure of confidential credentials and personal data if logs are accessed by unauthorized parties. The issue is classified under CWE-532, indicating insertion of sensitive information into log files. No patch or official remediation has been confirmed at this time.
CVE-2026-49204 is a medium severity vulnerability in the Acer Connect M6E 5G Portable WiFi Router involving leftover debug modules that contain hard-coded credentials for internal AWS Cognito test sandboxes. This exposure risks unauthorized access to internal assets. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network exploitable issue with low attack complexity and no required privileges or user interaction. The affected product is a cloud service, and a patch is available, with the vendor managing remediation for the cloud-hosted service.
CVE-2026-49202 is a high-severity vulnerability in the Acer Connect M6E 5G Portable WiFi Router. It allows access to internal multimedia session archives without requiring authentication. The issue is worsened by overly permissive Cross-Origin Resource Sharing (CORS) rules, which enable cross-site theft of these resources. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Acer Connect M6E 5G Portable WiFi Router contains an improper authentication vulnerability in its management API for cellular eSIM allocation. The API endpoints do not validate caller authorization, enabling remote attackers to rewrite or delete eSIM profiles without proper permissions. This vulnerability has a high severity score of 7.2 and affects the device's cellular management functionality.
CVE-2026-49194 is a critical improper authentication vulnerability in the Acer Connect M6E 5G Portable WiFi Router. The issue arises from a debugging routine named SCREEN_CLICK(5053) that allows bypassing the standard device login prompt and directly accessing an interactive shell interface without authentication. This vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact potential. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. The affected versions are not explicitly stated.
CVE-2026-49193 is a high-severity vulnerability in the Acer Connect M6E 5G Portable WiFi Router. It involves overly permissive configuration settings on cloud storage containers that expose active telemetry information publicly to the internet. This exposure allows unauthorized actors to access sensitive device telemetry data. No specific affected versions or patches are currently identified.
CVE-2026-49192 is an authorization bypass vulnerability in the Acer Connect M6E 5G Portable WiFi Router. The summary service endpoint does not verify user ownership of hardware serial numbers, allowing unauthorized access to device data. This issue is classified as an IDOR (Insecure Direct Object Reference) vulnerability. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No patch or official remediation has been confirmed at this time.
CVE-2026-49191 is a critical improper authentication vulnerability in the Acer Connect M6E 5G Portable WiFi Router. The M3WebServer component hard-codes backend API keys in the production build, which can be intercepted due to verbose error handling pages. This exposure allows attackers to potentially bypass authentication mechanisms.
CVE-2026-49190 is a critical OS command injection vulnerability in the Acer Connect M6E 5G Portable WiFi Router. The system improperly neutralizes special elements in OS commands due to failure in evaluating instructional permissions across multiple internal operation codes. This flaw allows unauthorized application installations or command executions without user interaction or elevated privileges.
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.