Which versions of Acer Connect M6E are affected by CVE-2026-50209?

The Acer Connect M6E 5G Portable WiFi Router (firmware ≤M6E_AI_1.00.000019) contains a critical vulnerability enabling local attackers to redirect device management to unauthorized servers,…

How to fix or mitigate CVE-2026-50209?

24 hours: Identify and inventory all Acer Connect M6E 5G routers and document current firmware versions. 7 days: Restrict local and physical access to affected devices (firmware ≤M6E_AI_1.00.000019); isolate from production networks where operationally feasible. 30 days: Monitor Acer security advisories for patch availability; if no patch is released within 60 days, develop replacement plan and initiate procurement of alternative 5G router solutions.

Acer Connect M6E CVE-2026-50209

Q: What is the CVSS score of CVE-2026-50209?

CVE-2026-50209 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34221 CRITICAL

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-06-04 Acer

GHSA-jwpr-997h-4qrm

Information Disclosure Connect M6E 5G Portable Wifi Router

9.3

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:06 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

9.3 (CRITICAL)

CVE Published

Jun 04, 2026 - 07:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.

AnalysisAI

Privilege escalation via MDM endpoint hijack in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤M6E_AI_1.00.000019) allows locally running malicious software to overwrite the default Mobile Device Management endpoint address through broadcast events, transferring administrative control of the device to an attacker-operated MDM server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected device is the Acer Connect M6E 5G Portable WiFi Router (CPE cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router), a mobile hotspot that supports Mobile Device Management for remote provisioning and policy enforcement. The root cause maps to CWE-732 (Incorrect Permission Assignment for Critical Resource): the MDM endpoint configuration - a security-critical setting that determines which remote server can administer the router - is exposed via broadcast intents/events without adequately restricting which on-device components may write to it. Because broadcast events on embedded Linux/Android-derived platforms are commonly receivable by any installed application, any app or sideloaded component running on the router's OS can issue the broadcast and silently re-point the MDM server URL.

RemediationAI

Patch status from the available data is ambiguous: the Acer knowledge base article (https://community.acer.com/en/kb/articles/19707) is the only vendor reference, and no specific fixed firmware build is named in the supplied intelligence, so this should be treated as patch available per vendor advisory - administrators should consult that article for the exact remediated M6E_AI build and upgrade any router running firmware ≤M6E_AI_1.00.000019. Until a confirmed fixed firmware is deployed, compensating controls include restricting which applications/components can be installed or executed on the router (avoid sideloading or untrusted apps on the management plane), pinning or whitelisting the legitimate MDM endpoint at the network layer (DNS/egress filtering to only the authorized MDM FQDN, blocking outbound TLS to unknown MDM domains), and monitoring the device's configured MDM URL for unauthorized changes; the trade-off is that egress filtering only stops the attacker MDM from being reachable, it does not prevent the on-device configuration rewrite itself, and DNS pinning may break legitimate MDM endpoint migrations.