Acer Connect M6E CVE-2026-50207

Attacker must already be running code locally on the Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) as an unprivileged on-device application that can reach the system Binder service exposing the AT-command pass-through; no user interaction, no elevated permissions, and no special configuration toggle are required because the pass-through accepts unverified commands by default. Exploitation is limited by the need to install or otherwise execute code on the device itself - it cannot be triggered from a remote network attacker, from a Wi-Fi client tethered through the hotspot without code execution on the hotspot, or against firmware builds released after M6E_AI_1.00.000019.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H reflects a high-impact local issue: any installed app with low privileges (no special permission, no user prompt) can both exfiltrate sensitive baseband data and brick connectivity. There is no EPSS score, no SSVC decision, no CISA KEV entry, and no public PoC visible in the supplied references, so this is best treated as a confirmed-by-vendor vulnerability rather than an actively exploited one. The realistic risk is moderate-to-high in threat models where untrusted side-loaded apps run on the device (consumer hotspot used as a hotspot/companion device), and lower in tightly controlled deployments. Note the description says 'local applications,' which is consistent with AV:L and PR:L - no conflict between vector and prose.

A user side-loads or is tricked into installing a benign-looking utility on the M6E. With only low-level local privileges and no user interaction, the app opens the exposed Binder endpoint and issues crafted AT commands that read baseband filesystem entries (leaking IMSI/EFS data) and then send a CFUN=0 / detach sequence to drop cellular service, denying connectivity to every device tethered to the hotspot.