Acer Connect M6E CVE-2026-50210

Q: What is the CVSS score of CVE-2026-50210?

CVE-2026-50210 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34222 MEDIUM

Information Exposure (CWE-200)

2026-06-04 Acer

GHSA-6x2q-59q4-vhpj

Information Disclosure Connect M6E 5G Portable Wifi Router

6.9

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:09 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

6.9 (MEDIUM)

CVE Published

Jun 04, 2026 - 07:22 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.

AnalysisAI

Static zero-filled AES-CBC Initialization Vectors in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) eliminate the cryptographic randomness CBC mode requires, enabling network-accessible attackers to conduct replay attacks and known-plaintext decryption of device-encrypted traffic without authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote access with no privileges or user interaction required, though the impact is scoped to partial confidentiality loss (VC:L) with no integrity or availability impact. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

AES-CBC (Cipher Block Chaining) mode is a symmetric encryption scheme that XORs each plaintext block with the previous ciphertext block before encryption - using an Initialization Vector as the 'previous block' for the first segment. When that IV is always a static zero-filled value rather than a random nonce, identical plaintexts always produce identical first ciphertext blocks, breaking semantic security. This enables known-plaintext attacks: an adversary who can predict or observe any portion of the plaintext (e.g., protocol headers, fixed strings, predictable fields) can use that knowledge to derive key material or decrypt adjacent blocks. Static IVs also facilitate replay attacks because captured ciphertext sequences can be retransmitted to reproduce device state without possessing the key. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected CPE is cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router covering all firmware revisions through M6E_AI_1.00.000019, as confirmed by EUVD-2026-34222.

RemediationAI

Consult the Acer advisory at https://community.acer.com/en/kb/articles/19707 for the patched firmware release; the exact fixed firmware version is not independently confirmed from available data and should be verified directly from that source before deployment. If firmware update is not immediately possible, apply the following specific compensating controls: disable or restrict remote administrative access to the device's management interface to reduce the attacker's ability to interact with encrypted sessions; avoid using the device to transmit sensitive credentials or session tokens until patched, as these are the highest-value targets for known-plaintext decryption; place the device behind a network-layer firewall that restricts inbound access to trusted IP ranges only, reducing the attacker's ability to capture traffic. Note that none of these mitigations address the root cryptographic flaw - they only reduce attacker access to the encrypted data stream. Only applying the vendor-released firmware resolves the underlying static IV issue.