Which versions of Acer Connect M6E are affected by CVE-2026-50207?

The Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) contains a local privilege escalation vulnerability allowing installed applications to extract sensitive…

How to fix or mitigate CVE-2026-50207?

24 hours: Identify all Acer Connect M6E devices in production and restrict installation of third-party applications to trusted sources only. 7 days: Evaluate alternative portable WiFi solutions without this vulnerability and begin migration planning. 30 days: Complete transition from affected Acer M6E devices or implement strict application installation controls and network-level isolation if replacement is not operationally feasible.

Acer Connect M6E CVE-2026-50207

Q: What is the CVSS score of CVE-2026-50207?

CVE-2026-50207 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34219 HIGH

Path Traversal (CWE-22)

2026-06-04 Acer

GHSA-jv9c-3q58-cmgw

Path Traversal Connect M6E 5G Portable Wifi Router

8.5

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:07 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

8.5 (HIGH)

CVE Published

Jun 04, 2026 - 07:04 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.

AnalysisAI

Local privilege abuse in the Acer Connect M6E 5G Portable WiFi Router lets installed applications smuggle raw AT commands across the Android system Binder boundary, where they are forwarded to the cellular baseband without verification. Up to and including firmware M6E_AI_1.00.000019, low-privileged local apps can read sensitive baseband files (IMSI, configuration blobs) and disable cellular connectivity, with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The M6E is an LTE/5G mobile hotspot built on an Android-derived platform that mediates app-to-modem traffic through Binder IPC. The flaw sits in the Binder service that proxies AT commands to the cellular radio: it acts as a pass-through without enforcing an allow-list, command-format validation, or path canonicalization on file-oriented AT commands. Because AT command sets include vendor-specific verbs that can read or write modem filesystem objects (NV items, EFS files), an unfiltered pass-through is mapped to CWE-22 (Path Traversal) - a local app can request modem-side file paths it should never reach. The same pass-through also exposes network-control verbs (CFUN, COPS, network detach) that toggle the radio state.

RemediationAI

Patch availability is not explicitly stated as a fixed version in the supplied data - treat this as 'Patch available per vendor advisory' and apply the firmware update referenced in Acer's KB at https://community.acer.com/en/kb/articles/19707 as soon as a release succeeding M6E_AI_1.00.000019 is published, verifying the build string in the device admin UI after upgrade. Until an updated firmware is installed, the practical compensating controls are to refuse installation of untrusted third-party applications on the hotspot (trade-off: blocks legitimate side-loaded tools), disable any developer/ADB modes that allow arbitrary package installation (trade-off: breaks diagnostics workflows), and physically restrict who can connect to or load software onto the device since the attack vector is local. Network-level filtering does not mitigate this issue because the abuse path is Binder IPC inside the device, not over the air.