Which versions of Acer Connect M6E are affected by CVE-2026-49189?

Acer Connect M6E 5G Portable WiFi Router firmware versions up to M6E_AI_1.00.000019 contain a local privilege escalation vulnerability (CVSS 8.5) allowing low-privileged local software to execute…

How to fix or mitigate CVE-2026-49189?

24 hours: Inventory all Acer Connect M6E 5G units and confirm firmware versions (≤M6E_AI_1.00.000019) affected. 7 days: Restrict unprivileged user and guest access to affected routers; implement local access controls limiting which processes can invoke privileged operations; request patch timeline from Acer. 30 days: Execute device replacement plan or migrate to alternative router models; establish continuous monitoring of affected devices if immediate replacement is not feasible.

Acer Connect M6E CVE-2026-49189

Q: What is the CVSS score of CVE-2026-49189?

CVE-2026-49189 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34208 HIGH

Improper Privilege Management (CWE-269)

2026-06-04 Acer

GHSA-hph7-5jr2-h359

Privilege Escalation Connect M6E 5G Portable Wifi Router Acer

8.5

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:46 vuln.today

CVSS changed

Jun 04, 2026 - 06:22 NVD

8.5 (HIGH)

CVE Published

Jun 04, 2026 - 05:23 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

AnalysisAI

Local privilege escalation in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤M6E_AI_1.00.000019) allows low-privileged local software components to invoke administrative operations via an unprotected Broadcast Receiver. CVSS 4.0 scores this 8.5 (High) with local attack vector and low privileges required, and no public exploit has been identified at time of analysis.

Technical ContextAI

The flaw resides in an Android-style Broadcast Receiver component exposed by software running on the Acer Connect M6E 5G Portable WiFi Router. Broadcast Receivers are intent-driven IPC endpoints; when declared with overly permissive (public/exported) access and lacking signature-level permissions or sender verification, any co-resident application or component can dispatch intents to invoke their handlers. This maps to CWE-269 (Improper Privilege Management): a privileged receiver accepts requests from unprivileged callers and performs administrative actions on their behalf, effectively bridging the privilege boundary between normal app components and the device's management surface.

RemediationAI

Upgrade the Acer Connect M6E firmware to a release later than M6E_AI_1.00.000019 once Acer publishes a fixed build, following the guidance in the Acer advisory at https://community.acer.com/en/kb/articles/19707; patch availability per vendor advisory should be confirmed against the linked KB. As a compensating control until the device is updated, avoid installing untrusted third-party applications or companion software on the same device or host that interacts with the router's management stack, since the attack requires a local, low-privileged software component as the entry point; uninstall any unnecessary companion apps and restrict who has physical or shell access to the device. Network-layer mitigations (firewalls, VLAN segmentation) will not address this issue because the attack vector is local to the device, not remote.