Acer Connect M6E CVE-2026-50210

The static zero IV flaw is present in the device's default firmware implementation - no non-default configuration is required to trigger it. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms remote unauthenticated exploitation requiring no user interaction against default deployments of the Acer Connect M6E running firmware ≤ M6E_AI_1.00.000019. Exploitation is bounded by two concrete requirements: the attacker must be positioned to intercept or capture the encrypted ciphertext produced by the device (network proximity or MITM capability), and must possess or be able to predict known-plaintext data corresponding to the intercepted ciphertext to perform decryption. The confidentiality impact is partial (VC:L), limiting the yield to data involved in the affected encryption operations rather than full device compromise. There is no integrity or availability impact per the CVSS vector.

The CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects an easily reachable, unauthenticated network attack surface - particularly significant for a portable WiFi router that may be deployed in untrusted public environments. However, the impact metrics are constrained: VC:L (low confidentiality impact on the vulnerable system) with no integrity or availability impact, indicating partial rather than full data disclosure. No EPSS score is provided in the available intelligence, KEV status is not confirmed, and no public POC has been identified at time of analysis. The practical risk is moderate-to-elevated for the deployment context: portable hotspots are frequently used in high-risk environments (travel, public venues) where adversarial network proximity is plausible, and the data encrypted by the device may include administrative credentials or session tokens. The zero-prerequisite CVSS profile (PR:N, UI:N, AC:L) means no barrier exists beyond network reachability, but successful exploitation still requires the attacker to intercept ciphertext and hold known-plaintext data to decrypt it - a meaningful but not insurmountable constraint.

An attacker on the same network segment as the Acer Connect M6E - or positioned to intercept its traffic via a man-in-the-middle technique in a public environment - captures AES-CBC encrypted communications produced by the device. Because the IV is always zero, the attacker identifies predictable plaintext segments (such as protocol preambles or fixed header fields) within the captured ciphertext and uses known-plaintext analysis to recover key material or decrypt adjacent data blocks. Previously captured sessions can also be replayed verbatim to reproduce device actions without possessing the encryption key. No public POC has been identified at time of analysis.