Which versions of Acer Connect M6E are affected by CVE-2026-50208?

Acer Connect M6E 5G Portable WiFi routers (firmware through M6E_AI_1.00.000019) contain cryptographic weaknesses enabling network-positioned attackers to decrypt communications between the device and…

How to fix or mitigate CVE-2026-50208?

24 hours: Conduct complete inventory of all Acer Connect M6E 5G devices, documenting firmware versions and network locations. 7 days: Isolate affected devices from networks handling sensitive data; implement network segmentation if immediate removal is infeasible, and assess what data may have transited these devices historically. 30 days: Execute replacement plan using alternative WiFi routers from vendors with demonstrated security patch cadence; update network procurement standards to require vendor commitment to timely security updates.

Acer Connect M6E CVE-2026-50208

Q: What is the CVSS score of CVE-2026-50208?

CVE-2026-50208 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34220 CRITICAL

Use of Insufficiently Random Values (CWE-330)

2026-06-04 Acer

GHSA-jvr3-h63f-grq7

Information Disclosure Connect M6E 5G Portable Wifi Router

9.2

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:07 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

9.2 (CRITICAL)

CVE Published

Jun 04, 2026 - 07:09 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.

AnalysisAI

Cryptographic weaknesses in the Acer Connect M6E 5G Portable WiFi Router (firmware versions through M6E_AI_1.00.000019) combine TrustAllCerts routines that bypass TLS certificate validation with hard-coded DES symmetric encryption keys, enabling a network-positioned attacker to decrypt traffic between the device and its backend services. CVSS 4.0 rates this 9.2 (Critical) given the unauthenticated network attack surface and high confidentiality/integrity impact, though attack complexity is rated High due to the MITM positioning requirement. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw involves two compounding cryptographic anti-patterns characteristic of CWE-330 (Use of Insufficiently Random Values) and related TLS-trust failures. 'TrustAllCerts' is a common Java/Android pattern where an X509TrustManager is implemented with empty checkClientTrusted/checkServerTrusted methods, accepting any certificate presented by a server and defeating the entire purpose of TLS authentication. Compounding this, DES is a 56-bit symmetric cipher considered cryptographically broken since the late 1990s; hard-coding the key in firmware means the same key is shared across every Acer Connect M6E unit, so anyone extracting the key from one device's firmware can decrypt traffic from all of them. The affected CPE is cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router, a 5G mobile hotspot likely used by travelers and remote workers.

RemediationAI

Consult Acer's advisory at https://community.acer.com/en/kb/articles/19707 and update the Acer Connect M6E firmware to the version released after M6E_AI_1.00.000019; an exact fix version is not independently confirmed from the input data, so verify the patched build number against Acer's KB article before deploying. Until firmware can be updated, avoid using the device on untrusted networks (public Wi-Fi backhaul, captive-portal hotel networks, foreign carrier SIMs where lawful intercept or hostile routing is plausible), and avoid management of the device over networks where MITM positioning is feasible. There is no clean workaround for hard-coded symmetric keys at the user level - the key cannot be rotated without a firmware change - so prioritize updating rather than relying on compensating controls.