Acer Connect M6E CVE-2026-50213

The attacker needs network reachability to the router's /v1/User/validate endpoint and knowledge of the identifier scheme used in the API path; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity are required against firmware ≤M6E_AI_1.00.000019. The principal limiting factor is reachability: as a portable 5G WiFi router, exposure is typically confined to clients associated with the device's SSID or anyone within radio range, unless remote-management is enabled which would extend exposure to the public WAN. No special configuration toggle is called out in the description as a precondition - the vulnerable endpoint appears to be present in the default firmware.

Signals are mostly consistent and point to a real, easily exploitable issue. The CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N with VC:H confirms a network-reachable, no-auth, no-user-interaction confidentiality-only impact, which matches a bulk data scraping primitive; integrity and availability are untouched (VI:N/VA:N), so this is purely a data-exposure bug, not RCE. EPSS and CISA KEV status were not provided in the input, so real-world exploitation prevalence cannot be quantified - score 8.7 reflects ease of exploitation rather than confirmed activity. The CWE-798 mapping conflicts with the description (which describes IDOR/enumeration, not hard-coded credentials), so the root-cause classification should be treated as unreliable until the Acer KB article is cross-checked. Realistic exposure depends heavily on whether the vulnerable endpoint is reachable only from the LAN/WiFi side of the router or also from the WAN interface - the description does not specify, and this single detail materially changes priority.

An attacker on the same WiFi network as a Connect M6E (e.g., a coffee-shop attendee, a guest in a corporate visitor SSID, or any party within radio range of an unsecured deployment) scripts a loop that issues GET /v1/User/validate requests across the predictable identifier range. Each response returns a full user profile sheet, and within minutes the attacker has exfiltrated the device's entire account database for downstream phishing, credential-stuffing, or targeted social engineering. If the management API is also reachable from the WAN side, the same loop runs unauthenticated from the public internet.