Acer Connect M6E CVE-2026-49192

Q: What is the CVSS score of CVE-2026-49192?

CVE-2026-49192 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34211 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-04 Acer

GHSA-873q-gr5f-jj67

Authentication Bypass Connect M6E 5G Portable Wifi Router

5.3

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:38 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

5.3 (MEDIUM)

DescriptionCVE.org

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

AnalysisAI

Insecure Direct Object Reference (IDOR) in the Acer Connect M6E 5G Portable WiFi Router's summary service endpoint allows authenticated remote users to access device data belonging to other users by supplying arbitrary hardware serial numbers the endpoint fails to validate against session ownership. The vulnerability affects all tracked versions per CPE data, requires only a valid authenticated session, and involves no user interaction or special configuration. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The root cause is CWE-639 (Authorization Through User-Controlled Key), a class of IDOR where a user-supplied identifier - in this case a hardware serial number - is used as the sole authorization token without binding it to the authenticated session's ownership record. The affected product is the Acer Connect M6E 5G Portable WiFi Router (CPE: cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router:*:*:*:*:*:*:*:*), a consumer-grade mobile hotspot device. The vulnerable 'summary service endpoint' is likely a cloud or web API aggregating device telemetry or configuration data. Because serial numbers on consumer hardware are often predictable, sequential, or structurally enumerable, an attacker can iterate over valid identifiers without requiring prior knowledge of specific victims. The tag 'Authentication Bypass' in the advisory is technically imprecise - authentication itself is not bypassed, but the authorization layer incorrectly treats serial number knowledge as proof of device ownership.

RemediationAI

Consult the Acer community advisory at https://community.acer.com/en/kb/articles/19707 for the official guidance and any released patch. A vendor-released fixed version is not independently confirmed from available data - the CPE wildcard and absence of a cited fix version mean the patch status cannot be verified without reviewing the advisory directly. As compensating controls, the summary service endpoint should enforce server-side validation that the requested serial number is associated with the authenticated user's account before returning data; this is a platform-side fix and is not user-configurable. If direct API access can be restricted, rate-limiting or anomaly detection on serial number lookup frequency per session can reduce bulk enumeration risk, though this does not eliminate the underlying authorization flaw. End users have limited direct mitigation options beyond monitoring for unauthorized access in account activity logs if such logging is offered by Acer.