Acer Connect M6E CVE-2026-49204

Q: What is the CVSS score of CVE-2026-49204?

CVE-2026-49204 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34216 MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-06-04 Acer

GHSA-7fjh-cg9f-j9fr

Authentication Bypass Connect M6E 5G Portable Wifi Router Acer

6.9

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:38 vuln.today

CVSS changed

Jun 04, 2026 - 07:22 NVD

6.9 (MEDIUM)

DescriptionCVE.org

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.

AnalysisAI

Hard-coded AWS Cognito credentials embedded in leftover debug modules of the Acer Connect M6E 5G Portable WiFi Router expose internal cloud test sandbox environments to remote unauthenticated attackers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no network proximity, and no user interaction is required, meaning any attacker who obtains the static credentials - through firmware extraction or disclosure - can authenticate to Acer's AWS Cognito-backed test infrastructure. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

The affected product is the Acer Connect M6E 5G Portable WiFi Router (CPE: cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router:*:*:*:*:*:*:*:*), a consumer-grade portable cellular hotspot device. The root cause class is CWE-798 (Use of Hard-coded Credentials), which occurs when credentials are compiled directly into firmware or software rather than generated per-deployment. In this case, debug modules intended for internal development and QA testing were inadvertently shipped in production firmware, and those modules contain static credentials for AWS Cognito - Amazon's managed identity and user pool service used for authentication and federated access. Because CWE-798 credentials are static across all deployed units, they cannot be rotated by end users and affect the entire installed base simultaneously. The target of exploitation is Acer's backend AWS Cognito test sandbox, not the device's local network or end-user data directly.

RemediationAI

Apply firmware updates for the Acer Connect M6E as directed by the Acer vendor advisory at https://community.acer.com/en/kb/articles/19707. No exact patched firmware version number was present in the available intelligence data; the advisory must be consulted directly to identify the minimum safe firmware version. As an interim compensating control, network administrators should restrict the device's management interface from unnecessary internet exposure to reduce the window for credential extraction or reconnaissance, though this does not eliminate the embedded credentials from existing firmware. Because CWE-798 hard-coded credentials are baked into the firmware image, no user-side configuration change can remediate this - a vendor-issued firmware update is the only definitive fix. Organizations managing fleets of these devices should prioritize update rollout given that all units share the same static credentials.