Acer Connect M6E CVE-2026-49193

No special conditions on the victim side - remote unauthenticated exploitation against the cloud storage containers serving the Acer Connect M6E 5G Portable WiFi Router telemetry pipeline, requiring only network reachability to the misconfigured cloud endpoint and no user interaction or credentials (CVSS AV:N/AC:L/AT:N/PR:N/UI:N). Exploitation is limited to data disclosure: the vector grants VC:H but VI:N/VA:N, so the attacker cannot modify telemetry, tamper with router behavior, or disrupt service, and the attacker must know or discover the storage container URL/namespace used by Acer's backend.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N indicates remote, unauthenticated, low-complexity access producing high confidentiality loss with no integrity or availability effect, yielding the 8.7 base score. EPSS, CISA KEV status, SSVC decision data, and POC availability were not provided in the input, so exploitation probability cannot be quantitatively benchmarked; no public exploit identified at time of analysis and there is no indication of confirmed active exploitation. Real-world risk is concentrated on data confidentiality and privacy of M6E telemetry rather than device takeover, but because the exposure is server-side and continuous, traditional endpoint mitigations on routers are ineffective - remediation depends entirely on Acer reconfiguring the cloud backend. Note that the description states 'overly permissive configuration settings' on the cloud side, which is consistent with the AV:N rating; the absence of EPSS/KEV signals means prioritization should rely on data sensitivity rather than exploitation telemetry.

An attacker enumerates Acer-operated cloud storage endpoints, identifies the publicly readable containers receiving Connect M6E telemetry, and issues unauthenticated HTTP GET requests to download the live telemetry stream. The harvested data could reveal device identifiers, network usage, subscriber location patterns, or operational metadata useful for surveillance, targeted follow-on attacks, or competitive intelligence; no public exploit identified at time of analysis, so the most realistic actor is one performing routine cloud-bucket reconnaissance.