Acer Connect M6E CVE-2026-49189

The attacker must already be able to run a local, low-privileged software component on the Acer Connect M6E 5G Portable WiFi Router (PR:L, AV:L) - for example a sideloaded or companion application - and the device must be running firmware at or below M6E_AI_1.00.000019 where the core Broadcast Receiver is declared with unchecked public access permissions. No user interaction is required (UI:N) once the malicious local component is present, and no special non-default configuration is needed because the vulnerable receiver is part of the device's core software. Exploitation is limited by the requirement of local code execution on the device itself, which means remote-only attackers cannot trigger this directly.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a local attack requiring low privileges, no user interaction, and yielding high confidentiality, integrity, and availability impact on the vulnerable component - a profile consistent with on-device privilege escalation rather than remote compromise. There is no CISA KEV listing, no EPSS data, and no public exploit identified at time of analysis, suggesting the practical risk is contingent on an attacker first achieving local code execution (e.g., via a malicious companion app or a sideloaded payload) on the device. Because the device is a portable consumer 5G router rather than a fleet-scale enterprise target, exploitation is more plausible as part of a chained attack against an individual user than as widespread opportunistic abuse; the high CVSS score reflects severe technical impact post-foothold, not ease of initial access.

An attacker convinces the victim to install a benign-looking application on a phone or device paired with the Acer Connect M6E (or otherwise plants a low-privileged process on it); that application sends a crafted intent to the exposed Broadcast Receiver and triggers administrative operations such as configuration changes or privileged command execution without holding admin rights. No public exploit code has been identified at time of analysis, but the construction of a proof-of-concept intent-broadcaster is straightforward for an attacker familiar with the platform.