Which versions of Acer Connect M6E are affected by CVE-2026-49186?

Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) contains an authentication bypass vulnerability enabling any connected client to enumerate hidden network devices…

How to fix or mitigate CVE-2026-49186?

Within 24 hours: Identify all Acer Connect M6E 5G routers in your environment and verify firmware version M6E_AI_1.00.000019 or earlier; restrict network access to the router to authorized clients only. Within 7 days: Implement network segmentation to isolate affected routers from critical systems and sensitive device clusters; enable MQTT traffic logging to detect wildcard subscription attempts. Within 30 days: Monitor Acer security advisories for firmware patches for model M6E_AI; prepare hardware replacement options if patch is not released within 90 days.

Acer Connect M6E CVE-2026-49186

Q: What is the CVSS score of CVE-2026-49186?

CVE-2026-49186 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34200 HIGH

Improper Authentication (CWE-287)

2026-06-04 Acer

GHSA-vvpf-h42q-v96v

Authentication Bypass Connect M6E 5G Portable Wifi Router Acer

8.6

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 06:15 vuln.today

CVSS changed

Jun 04, 2026 - 04:22 NVD

8.6 (HIGH)

CVE Published

Jun 04, 2026 - 03:36 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters ( # or +) to enumerate hidden network devices or publish rogue control commands.

AnalysisAI

Authentication bypass on the local MQTT broker of the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) allows any connected client to subscribe with wildcard topics (

or +) and either enumerate hidden network devices or publish rogue control commands. CVSS 4.0 rates this 8.6 (High) with network attack vector and high confidentiality/integrity/availability impact; no public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

MQTT (Message Queuing Telemetry Transport) is a lightweight publish/subscribe protocol commonly embedded in IoT and consumer networking gear for inter-process and device-to-device control messaging. The vulnerability maps to CWE-287 (Improper Authentication): the broker accepts client subscriptions without enforcing topic-level Access Control Lists, so authorisation checks that should gate which topics each client can read or write are effectively absent. Wildcard subscriptions ('#' matches all remaining topic levels, '+' matches one level) let a single subscriber observe every message on the bus, while unrestricted publish rights let an attacker inject control-plane messages the device firmware trusts. Per the CPE (cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router) this is bounded to the Acer Connect M6E 5G portable router product line.

RemediationAI

No vendor-released patch version is identified in the available data; the only reference is the Acer community knowledge-base article at https://community.acer.com/en/kb/articles/19707, which should be consulted for the latest firmware bulletin and applied as soon as Acer ships a build later than M6E_AI_1.00.000019. Until a fixed firmware is available, restrict Wi-Fi access to trusted users only by setting a strong WPA2/WPA3 passphrase and disabling guest networks, isolate the router on networks where untrusted clients may join, and where the broker port is exposed on the LAN consider firewalling or blocking external traffic to MQTT ports (1883/8883) at any upstream router - note these LAN-side mitigations do not protect against a malicious client already authenticated to Wi-Fi, so reducing the number of trusted clients is the most effective compensating control.