Which versions of Acer Connect M6E are affected by CVE-2026-49187?

The Acer Connect M6E 5G portable WiFi router contains statically provisioned credentials in its companion mobile application, enabling remote attackers to gain administrative access to any affected…

How to fix or mitigate CVE-2026-49187?

24 hours: Inventory all Acer Connect M6E 5G routers (firmware M6E_AI_1.00.000019 and earlier); document current configuration and isolation status; restrict network access to management interfaces. 7 days: Request patch timeline and product security support from Acer; implement network segmentation to isolate affected routers from critical systems; disable remote management features if operationally feasible. 30 days: Procure and deploy replacement routers from alternative vendors; maintain enhanced monitoring of any remaining devices; verify all affected routers have been replaced or permanently isolated.

Acer Connect M6E CVE-2026-49187

Q: What is the CVSS score of CVE-2026-49187?

CVE-2026-49187 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34204 HIGH

Information Exposure (CWE-200)

2026-06-04 Acer

GHSA-mgmr-hqww-q343

Information Disclosure Connect M6E 5G Portable Wifi Router Acer

8.7

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:45 vuln.today

CVSS changed

Jun 04, 2026 - 06:22 NVD

8.7 (HIGH)

CVE Published

Jun 04, 2026 - 03:50 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

AnalysisAI

Information disclosure in the Acer Connect M6E 5G Portable WiFi Router (firmware versions up to and including M6E_AI_1.00.000019) stems from hard-coded, non-expiring credentials embedded in the companion APK that are shared across all deployments. Remote attackers can extract these static secrets from any copy of the application and use them to access sensitive router data without authentication, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Android management application (APK) shipped for the Acer Connect M6E 5G Portable WiFi Router, a consumer/SMB mobile broadband device. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is realized here through hard-coded resource files bundled inside the APK - likely API tokens, certificates, or a shared 'scepter' (signing/session key) - which never rotate or expire. Because Android APKs are trivially decompiled with tools such as apktool or jadx, any user can extract the static material; since the same secret is reused across every router/APK pair, it functions as a global master credential rather than a per-device value.

RemediationAI

Patch status is unclear from the provided data - Acer's community advisory at https://community.acer.com/en/kb/articles/19707 should be consulted for the fixed firmware and APK build; no vendor-released patch version was independently confirmed in the supplied intelligence. Until a fixed APK and firmware are installed, compensating controls include disabling remote management features on the M6E (so the leaked credential cannot reach exposed APIs from the internet), restricting the router's WAN-side management interface via the device's firewall settings, and rotating any user-controlled secrets (Wi-Fi PSK, admin password) that may have been retrievable via the same channel; note that disabling remote management will break legitimate mobile-app administration over cellular networks. Operators should also monitor Acer's advisory page for a firmware version superseding M6E_AI_1.00.000019.