Acer Connect M6E CVE-2026-49203

Exploitation requires adjacent-network access (AV:A) - the attacker must be associated with the same Wi-Fi network served by the Acer Connect M6E 5G portable router, meaning physical proximity and either an open SSID, knowledge of the Wi-Fi passphrase, or a successful crack of it. No authentication to the router's management plane is needed (PR:N) and no user interaction is required (UI:N); the specific prerequisite is the ability to reach the cellular eSIM management API endpoints over the LAN/WLAN interface. Limiting factors include the need for proximity (this is not internet-exposed by default for a portable hotspot), and that impact is constrained to the cellular eSIM profile on the device - confidentiality of user traffic is only marginally affected (VC:L) and there is no documented pivot into other systems (SC:N/SI:N/SA:N).

The CVSS 4.0 vector indicates Adjacent network attack vector (AV:A), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with high impact on integrity and availability of the vulnerable component (VI:H/VA:H) but only low confidentiality impact (VC:L) and no subsequent-system impact - yielding the 7.2 score. The adjacent-network requirement (an attacker must be on the same Wi-Fi or local network segment as the router) materially limits blast radius compared with a fully remote-internet flaw, but for a portable hotspot frequently used in cafes, hotels, and conference venues this is a realistic exposure. No EPSS score, KEV listing, or POC is included in the provided intelligence, so there is no public exploit identified at time of analysis; the absence of an EPSS/KEV signal is not confirmation that exploitation is unlikely, only that no telemetry has been supplied. Prioritization should be high for organizations issuing M6E units to traveling staff because successful exploitation can wipe or hijack cellular connectivity.

An attacker associates with the Acer Connect M6E's Wi-Fi network - for example by joining an open hotspot at an airport lounge or cracking a weak passphrase - and then sends crafted HTTP requests to the router's eSIM management API endpoints. Because the endpoints do not check caller authorization, the attacker can rewrite the victim's cellular profile (potentially redirecting traffic through an attacker-controlled carrier configuration) or delete it outright, knocking the victim off cellular data. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization straightforward once endpoint paths are known.