Which versions of Acer Connect M6E are affected by CVE-2026-49193?

Acer Connect M6E 5G routers contain a cloud storage misconfiguration that allows unauthenticated remote access to operational telemetry, creating a confidentiality breach for organizations using…

How to fix or mitigate CVE-2026-49193?

24 hours: Inventory all Acer Connect M6E 5G devices; verify cloud storage bucket permissions are private and disable cloud telemetry/synchronization features on all units. 7 days: Implement network segmentation to restrict affected routers' outbound cloud connectivity via firewall rules or internal proxy; enable access logging on cloud storage to detect suspicious activity; contact Acer for patch availability timeline and evaluate replacement router models. 30 days: Procure and deploy alternative portable WiFi routers from vendors with verified secure-by-default cloud practices; complete replacement of all business-critical Acer M6E 5G deployments.

Acer Connect M6E CVE-2026-49193

Q: What is the CVSS score of CVE-2026-49193?

CVE-2026-49193 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34212 HIGH

Information Exposure (CWE-200)

2026-06-04 Acer

GHSA-j35w-fvr7-hfg9

Information Disclosure Connect M6E 5G Portable Wifi Router

8.7

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:31 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

8.7 (HIGH)

DescriptionCVE.org

Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.

AnalysisAI

Public exposure of telemetry data affects Acer Connect M6E 5G Portable WiFi Router, where misconfigured cloud storage containers leave active device telemetry readable from the internet without authentication. Remote unauthenticated parties can harvest sensitive operational data per the CVSS 4.0 vector (AV:N/PR:N/UI:N, VC:H), and no public exploit identified at time of analysis. The 8.7 CVSS score reflects the high confidentiality impact even though integrity and availability are unaffected.

Technical ContextAI

The issue stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and manifests at the cloud-storage layer that backs the Acer Connect M6E 5G Portable WiFi Router (CPE cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router). Cloud storage containers - typically object-storage buckets such as S3-style endpoints used to receive device telemetry - were provisioned with access-control policies that permit anonymous reads from the public internet. Because telemetry is continuously written by deployed routers, the misconfiguration exposes a live data feed rather than a static dataset, amplifying the impact of a classic information-disclosure weakness.

RemediationAI

Patch status: Patch available per vendor advisory - Acer indicates remediation via the Acer community knowledge base article at https://community.acer.com/en/kb/articles/19707, which owners of the Connect M6E should consult for confirmation that the cloud storage container ACLs have been tightened. Because the misconfiguration is server-side and on Acer's infrastructure, end users cannot patch this directly; verify with Acer that the public-read policy has been removed and that previously exposed telemetry has been audited. Compensating controls customers can apply include disabling cloud telemetry/companion-app features on the router if the device exposes that toggle (trade-off: loss of remote management and analytics functionality), and rotating any credentials, network identifiers, or account tokens that may have been included in the leaked telemetry stream.