Which versions of Acer Connect M6E are affected by CVE-2026-49202?

The Acer Connect M6E 5G Portable WiFi Router allows unauthenticated remote attackers to access sensitive multimedia session data, with misconfigured cross-origin policies enabling them to steal this…

How to fix or mitigate CVE-2026-49202?

24 hours: Identify and inventory all Acer Connect M6E 5G routers across the organization and document their network locations. 7 days: Isolate affected devices through network segmentation or firewall rules blocking external API access; disable multimedia session recording if operationally feasible. 30 days: Contact Acer for official patch availability and timeline; if no patch is forthcoming, develop and execute a hardware replacement or upgrade plan.

Acer Connect M6E CVE-2026-49202

Q: What is the CVSS score of CVE-2026-49202?

CVE-2026-49202 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34215 HIGH

Improper Authentication (CWE-287)

2026-06-04 Acer

GHSA-hfx8-6pxq-3fx3

Authentication Bypass Connect M6E 5G Portable Wifi Router Acer

8.8

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:32 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

8.8 (HIGH)

DescriptionCVE.org

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.

AnalysisAI

Unauthenticated exposure of internal multimedia session archives in the Acer Connect M6E 5G Portable WiFi Router lets remote attackers retrieve sensitive recorded session data, and overly permissive CORS rules amplify the issue by enabling cross-origin theft from any web context a victim visits. CVSS 4.0 rates this 8.8 (high) with network attack vector, no privileges, and no user interaction; no public exploit identified at time of analysis.

Technical ContextAI

The affected device is Acer's Connect M6E 5G portable WiFi router (cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router), which exposes an HTTP-based management/media interface for end users. The root cause is CWE-287 (Improper Authentication): an internal endpoint that serves multimedia session archives is reachable without any credential check, and the situation is compounded by permissive CORS response headers (likely Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials, or wildcard reflection) that allow browser-based cross-origin reads of those archives. CORS misconfiguration on top of broken authentication is a well-known amplifier because it converts a same-network info-disclosure flaw into something exploitable from arbitrary attacker-controlled web pages a user visits while connected to the device.

RemediationAI

Patch availability per vendor advisory is referenced via Acer's knowledge base entry at https://community.acer.com/en/kb/articles/19707; administrators should apply the firmware update Acer publishes there as soon as it is available, since an exact fix version is not included in the provided input. Until the device is updated, compensating controls are to avoid connecting trusted clients to the router while browsing untrusted websites (the CORS angle requires a victim browser, so reducing cross-origin exposure helps), restrict access to the router's management/media interface to wired or known clients only via firewall/ACL settings if the firmware supports it, disable any media-sharing or session-archive feature in the device's web UI to remove the vulnerable endpoint, and segregate the router on a dedicated SSID with client isolation enabled - trade-offs include loss of legitimate multimedia/sharing functionality and added configuration complexity for travelers.