Acer Connect M6E CVE-2026-50205

Exploitation requires the affected Acer Connect M6E 5G Portable WiFi Router to have the SMTP notification/alerting feature configured with credentials (otherwise no SMTP secret is logged) and the attacker must have a path to the device's system log output - either via the web admin log-viewer, a remote syslog destination, or direct file access on the device. The CVSS 4.0 vector (AV:N/PR:N/UI:N) asserts no authentication or user interaction is required, implying the log retrieval surface is reachable over the network without credentials in the affected configuration; defenders should verify whether their deployment exposes the management interface to untrusted networks, as a router placed behind a trusted LAN with no WAN-side admin access materially limits exploitability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) indicates network-reachable, unauthenticated, low-complexity access yielding high confidentiality impact - consistent with retrievable log output exposing credentials. However, the realistic risk depends on a key unverified prerequisite: whether the log interface is actually network-exposed without authentication, or whether AV:N reflects the broader management-plane reachability with implicit access to logs. The advisory description does not specify the retrieval path, and EPSS data, KEV status, and POC availability are all absent from the provided intelligence - there is no public exploit identified at time of analysis and the issue is not in CISA KEV. Net risk is meaningful for organizations using these routers with SMTP notification configured (credential reuse risk into corporate mail infrastructure), but exploitation is likely opportunistic against exposed management interfaces rather than mass-scanned.

An attacker who reaches the router's management or log interface - for example via an exposed admin portal on a public IP, a guest Wi-Fi segment, or lateral movement on the local network - retrieves the system log and extracts the plaintext SMTP authentication password and corporate employee identifiers. The recovered SMTP credential is then leveraged to send phishing emails from the organization's legitimate mail server or, if reused, to pivot into corporate identity systems. No public exploit identified at time of analysis, and exploitation requires only routine log retrieval rather than custom tooling.