Which versions of Acer Connect M6E are affected by CVE-2026-50213?

The Acer Connect M6E 5G Portable WiFi Router contains a critical flaw allowing unauthenticated remote attackers to harvest complete user profile data through predictable endpoint enumeration.

How to fix or mitigate CVE-2026-50213?

Within 24 hours: Inventory all Acer Connect M6E 5G devices across the organization and isolate affected units from the network pending vendor remediation. Within 7 days: Notify all users who have connected to or configured these devices of the data exposure and advise credential rotation. Within 30 days: Monitor Acer security advisories for a patched firmware version and conduct a full assessment of any user data that may have been accessed.

Acer Connect M6E CVE-2026-50213

Q: What is the CVSS score of CVE-2026-50213?

CVE-2026-50213 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34225 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-06-04 Acer

GHSA-6gcf-89c7-vx3x

Authentication Bypass Connect M6E 5G Portable Wifi Router Acer

8.7

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:05 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

8.7 (HIGH)

CVE Published

Jun 04, 2026 - 07:39 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.

AnalysisAI

Mass user data harvesting on the Acer Connect M6E 5G Portable WiFi Router is possible because the unauthenticated /v1/User/validate endpoint returns full user profile sheets keyed by predictable identifier strings. Remote attackers can iterate through identifiers to scrape every account's profile data without credentials, and no public exploit identified at time of analysis though the trivial attack pattern makes weaponization straightforward.

Technical ContextAI

The vulnerability sits in the router's web/API stack - specifically a REST-style account validation endpoint at /v1/User/validate that is intended to confirm whether an account exists but instead echoes back a comprehensive profile data sheet. Combined with predictable (likely sequential or otherwise guessable) identification strings, this becomes an enumeration sink: any attacker who can reach the management interface can walk the identifier space and extract every stored user record. The assigned CWE-798 (Use of Hard-coded Credentials) does not cleanly match the described behavior, which reads as a classic Insecure Direct Object Reference / broken access control issue (closer to CWE-639 or CWE-284); the Acer tag of 'Authentication Bypass' aligns better, suggesting the endpoint may also be missing the authentication check that should gate /v1/User/* routes on this Connect M6E embedded platform.

RemediationAI

Patch status: no vendor-released patched firmware version is identified in the supplied data - the Acer KB article (https://community.acer.com/en/kb/articles/19707) is the sole vendor reference and should be consulted for any newer firmware build above M6E_AI_1.00.000019. Until a fixed image is confirmed, restrict who can reach the router's management API: disable remote/WAN administration if enabled (this loses off-network management), place the router's management interface on an isolated VLAN or guest-segregated SSID so only trusted clients can hit /v1/User/validate (this complicates legitimate admin from other devices), and block inbound traffic to the management port at any upstream firewall. Operators should also rotate any user account data that may already have been harvested, since this is a confidentiality issue and prior leakage cannot be undone by a future patch.