Which versions of Acer Connect M6E are affected by CVE-2026-49203?

A management API authentication flaw in the Acer Connect M6E 5G Portable WiFi Router (CVE-2026-49203, CVSS 7.2) allows local network attackers to manipulate or delete cellular eSIM profiles without…

How to fix or mitigate CVE-2026-49203?

Within 24 hours: Audit deployment of Acer Connect M6E 5G routers in production and critical infrastructure environments. Within 7 days: Implement network segmentation, firewall rules, or access controls to restrict management API access to authorized networks; disable unnecessary remote management features. Within 30 days: Monitor Acer security advisories for patch releases; establish replacement or upgrade plan for devices running unpatched firmware.

Acer Connect M6E CVE-2026-49203

Q: What is the CVSS score of CVE-2026-49203?

CVE-2026-49203 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34214 HIGH

Improper Authentication (CWE-287)

2026-06-04 Acer

GHSA-hhrg-xw9w-2f4q

Authentication Bypass Connect M6E 5G Portable Wifi Router Acer

7.2

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

7.2 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:32 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

7.2 (HIGH)

DescriptionCVE.org

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

AnalysisAI

Unauthorized eSIM profile manipulation in the Acer Connect M6E 5G Portable WiFi Router allows adjacent attackers to rewrite or delete cellular eSIM profiles without authentication because management API endpoints fail to validate caller authorization. The flaw maps to CWE-287 (Improper Authentication) and is reported by Acer with CVSS 4.0 score 7.2, with no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in management API endpoints used to provision and administer cellular eSIM profiles on the Acer Connect M6E 5G portable WiFi router (CPE cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router). eSIM (embedded SIM) profile management typically involves sensitive provisioning operations governed by GSMA SGP.22/SGP.32 specifications, where remote profile rewrite or deletion should only be possible by an authenticated, authorized entity such as the SM-DP+ server or device owner. CWE-287 (Improper Authentication) describes the root cause: the device exposes profile-modifying endpoints without verifying the identity or authorization level of the caller, effectively trusting any request that reaches the management interface.

RemediationAI

Patch available per vendor advisory - administrators should consult the Acer advisory at https://community.acer.com/en/kb/articles/19707 and apply the firmware update Acer publishes for the Connect M6E as soon as it is offered through the device's update mechanism, since the exact fixed version is not enumerated in the provided data. As a compensating control until firmware is applied, restrict who can associate with the router's Wi-Fi by enforcing a strong WPA3/WPA2 passphrase and disabling any open or guest SSIDs (trade-off: reduces convenience for casual sharing), and where possible isolate the device's management interface to a dedicated administrative SSID or wired management port so adjacent-network attackers cannot reach the eSIM management API (trade-off: requires reconfiguration and may break existing client workflows). Avoid using the router in untrusted environments such as public conference Wi-Fi sharing setups, and back up or document the active eSIM profile so it can be reprovisioned with the carrier if an attacker deletes it.