Which versions of Connect M6E 5G Portable Wifi Router are affected by CVE-2026-50212?

Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) contains an unauthenticated denial-of-service vulnerability allowing attackers on adjacent networks to forcibly…

How to fix or mitigate CVE-2026-50212?

24 hours: Inventory all Acer Connect M6E routers in production and confirm firmware version (affected: M6E_AI_1.00.000019 and earlier). 7 days: Isolate affected routers from critical-path network operations; disable remote management interfaces if available and enable strongest available wireless encryption (WPA3 preferred). 30 days: Evaluate replacement router models from security-hardened vendors; establish vendor contact for patch availability confirmation and plan hardware refresh timeline.

Connect M6E 5G Portable Wifi Router CVE-2026-50212

Q: What is the CVSS score of CVE-2026-50212?

CVE-2026-50212 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34224 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-04 Acer

GHSA-5q75-v747-f499

Denial Of Service Connect M6E 5G Portable Wifi Router

7.1

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:05 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

7.1 (HIGH)

CVE Published

Jun 04, 2026 - 07:32 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.

AnalysisAI

Denial of service in the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) lets an unauthenticated attacker on the adjacent network abuse the device dissociation API to forcibly unbind arbitrary client endpoints from the router. With no public exploit identified at time of analysis and no CISA KEV listing, this is a connectivity-disruption issue rather than a code execution risk, but it can knock legitimate users off the WiFi at will. CVSS 4.0 scores it 7.1 due to high availability impact via a low-complexity, no-privilege adjacent attack.