Which versions of Acer M3WebServer are affected by CVE-2026-49191?

The Acer Connect M6E 5G Portable WiFi Router contains a critical remote authentication bypass affecting the M3WebServer component that exposes hardcoded API credentials, allowing unauthenticated…

How to fix or mitigate CVE-2026-49191?

24 hours: Identify and inventory all Acer Connect M6E 5G devices in use across the organization and document their network locations. 7 days: Segment affected routers to isolated network zones with restricted administrative access; implement firewall policies blocking access to administrative interfaces from untrusted networks; scan affected devices for indicators of compromise. 30 days: Execute procurement for replacement routers from alternative manufacturers; physically retire and securely dispose of affected units; establish vendor security update requirements for future network equipment purchases.

Acer M3WebServer CVE-2026-49191

Q: What is the CVSS score of CVE-2026-49191?

CVE-2026-49191 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34210 CRITICAL

Improper Authentication (CWE-287)

2026-06-04 Acer

GHSA-gpg2-45rx-77ff

Authentication Bypass Connect M6E 5G Portable Wifi Router

9.3

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:30 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

9.3 (CRITICAL)

DescriptionCVE.org

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.

AnalysisAI

Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router's M3WebServer production build exposes hard-coded backend API keys through verbose error pages, enabling remote unauthenticated attackers to harvest credentials and gain full administrative control over the device. CVSS 4.0 scores this 9.3 (Critical) with no privileges or user interaction required, though no public exploit has been identified at time of analysis.

Technical ContextAI

The M3WebServer is the embedded web-management component shipped on Acer's Connect M6E 5G portable WiFi router (CPE cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router). The flaw maps to CWE-287 (Improper Authentication) but is rooted in two compounding weaknesses: secrets baked into the production firmware build (a CWE-798 hard-coded credentials pattern) combined with overly verbose error responses (CWE-209 information exposure through error messages) that leak those secrets to any HTTP client capable of triggering the error path. Because the leaked tokens are backend API keys rather than per-user session tokens, possession of them is treated by the backend as proof of identity, collapsing the authentication boundary on devices using the same firmware image.

RemediationAI

Apply the firmware update referenced in Acer's advisory at https://community.acer.com/en/kb/articles/19707 as the primary fix; an exact patched firmware version was not included in the supplied intelligence, so administrators should treat the vendor article as the authoritative source for the specific build number. Until firmware can be deployed, restrict management-plane reachability by disabling remote/WAN administration on the router, binding the web UI to the LAN interface only, and placing the device behind a perimeter ACL that blocks inbound HTTP/HTTPS to the management port - note that this does not protect against an attacker already on the WiFi network. Disabling verbose/debug error pages if the device exposes that toggle reduces leakage but does not remove the hard-coded keys themselves, so any device suspected of exposure should also have its backend API keys rotated by the vendor-supplied procedure once the patched firmware is installed.