Acer Connect M6E CVE-2026-49187

Exploitation requires that the Acer Connect M6E 5G Portable WiFi Router be running firmware at or below M6E_AI_1.00.000019 with its companion Android APK in use, and that the API endpoints or device interfaces which trust the hard-coded shared secret be reachable by the attacker (network attack vector per CVSS AV:N). No authentication, user interaction, or special privileges are required (PR:N/UI:N). The principal limiting factor is reachability of the endpoint that consumes the leaked credential: if Acer's cloud service or the router's management API is exposed only to the LAN or to a vendor backend, internet exploitation is constrained accordingly - the advisory does not clarify which endpoint trusts the scepter, so defenders should verify by inspecting the device's listening services.

The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) yields 8.7 - network-reachable, low complexity, no privileges or user interaction, and high confidentiality impact with no integrity or availability effect, which matches a credential/data-disclosure flaw rather than an RCE. There is no CISA KEV listing, no EPSS score provided, and no public POC identified, so real-world exploitation pressure is currently unproven despite the high score; however, because the secret is static and recoverable from any APK copy, weaponization cost is effectively zero once a researcher publishes the extracted material. Integrity and availability impacts are scored None, so this is a confidentiality-only issue - prioritize based on what data the leaked credential unlocks (subscriber info, device telemetry, admin endpoints), which the public advisory does not enumerate.

An attacker downloads the Acer Connect companion APK from a public mirror, decompiles it with jadx, and extracts the hard-coded 'scepter' token from its resource files. Because the same token is embedded in every distribution, the attacker can then issue authenticated-looking API calls to any internet-reachable M6E device or backend service that trusts the shared secret, harvesting subscriber/device data at scale without ever touching the victim's network directly.