Which versions of Acer Connect M6E are affected by CVE-2026-49194?

The Acer Connect M6E 5G Portable WiFi Router contains a critical authentication bypass (CVE-2026-49194, CVSS 9.4) enabling remote attackers to gain unauthorized administrative control of the device…

How to fix or mitigate CVE-2026-49194?

24 HOURS: Inventory all Acer Connect M6E 5G routers in deployment; disable remote management features; isolate affected devices to trusted networks only. 7 DAYS: Monitor Acer security advisories for patch release; develop replacement/upgrade contingency plan. 30 DAYS: Apply vendor patch immediately upon release, or replace affected routers with alternatives if patch timeline is uncertain.

Acer Connect M6E CVE-2026-49194

Q: What is the CVSS score of CVE-2026-49194?

CVE-2026-49194 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34213 CRITICAL

Improper Authentication (CWE-287)

2026-06-04 Acer

GHSA-45g5-qmv3-9f22

Authentication Bypass Connect M6E 5G Portable Wifi Router

9.4

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:31 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

9.4 (CRITICAL)

DescriptionCVE.org

The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.

AnalysisAI

Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router allows low-privileged remote attackers to reach a debug routine (SCREEN_CLICK opcode 5053) that skips the device login prompt and drops the caller directly into an interactive shell. CVSS 4.0 rates the issue 9.4 with scope change and high impact on confidentiality, integrity, and availability of both the router and connected subsystems; no public exploit identified at time of analysis.

Technical ContextAI

The affected device is the Acer Connect M6E, a 5G portable WiFi router that exposes a management/diagnostic interface. The vulnerability is rooted in CWE-287 (Improper Authentication): a debugging code path identified as SCREEN_CLICK(5053) bypasses the normal credential prompt and hands the requester an interactive shell on the underlying embedded OS. Such debug 'screens' are common in consumer router firmware where engineering menus are gated by an authentication shim that is later reachable via a network-facing service; reaching the routine therefore short-circuits the authentication state machine rather than escalating from a normal shell user.

RemediationAI

Apply the firmware update referenced in Acer's advisory at https://community.acer.com/en/kb/articles/19707 as the primary fix - the exact patched firmware version is not present in the supplied data, so cross-check the build number listed there against the version reported by the router's management UI. Until the device is updated, restrict management-plane access to the router by disabling remote (WAN) administration, placing the device's admin interface behind a separate management VLAN or trusted client list, and rotating any low-privilege accounts that could be used to reach the debug routine; on a portable device the practical compensating control is to keep it on trusted networks only and power it down when not in use, accepting the loss of remote management as the trade-off.