Which versions of Acer Connect M6E are affected by CVE-2026-50214?

The Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) contains a critical unauthenticated remote authentication bypass vulnerability allowing attackers to gain complete…

How to fix or mitigate CVE-2026-50214?

Within 24 hours: Inventory all Acer Connect M6E 5G devices in production infrastructure and identify their current firmware versions; assess network exposure of affected units. Within 7 days: Contact Acer support to determine if patched firmware is available for your current firmware revision; implement firewall rules or network segmentation restricting access to the router's /v1/Plan API endpoint. Within 30 days: Deploy firmware patches to all affected devices when available; conduct comprehensive audit of all access plans and billing records to identify unauthorized modifications since device deployment.

Acer Connect M6E CVE-2026-50214

Q: What is the CVSS score of CVE-2026-50214?

CVE-2026-50214 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34228 CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-06-04 Acer

GHSA-w6gp-x68f-qxch

Information Disclosure Connect M6E 5G Portable Wifi Router

9.3

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 12:21 vuln.today

CVSS changed

Jun 04, 2026 - 10:22 NVD

9.3 (CRITICAL)

CVE Published

Jun 04, 2026 - 09:20 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.

AnalysisAI

Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) allows remote attackers to abuse a hardcoded global API token guarding the /v1/Plan service, granting full administrative control over network access plans. Unauthenticated attackers can create arbitrary zero-cost plans, effectively bypassing billing and access controls. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects trivial network exploitability with no privileges or user interaction required.

Technical ContextAI

The affected device is the Acer Connect M6E, a 5G portable WiFi router/hotspot that exposes a REST-style management API. The /v1/Plan endpoint handles network access plan provisioning (the metering/quota layer that controls connectivity entitlements). Per CWE-345 (Insufficient Verification of Data Authenticity), the endpoint relies solely on a single shared global API token rather than per-user authentication or signed/origin-verified requests. Because the token is global and embedded in the device/app firmware, any party who can recover or replay it effectively becomes an administrator. The CPE cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router pins this to the Acer Connect M6E product family at firmware M6E_AI_1.00.000019 and earlier.

RemediationAI

Consult the Acer advisory at https://community.acer.com/en/kb/articles/19707 for the vendor-supplied fix; the public input data does not enumerate a specific patched firmware build, so this should be treated as 'Patch available per vendor advisory' pending confirmation of the exact post-M6E_AI_1.00.000019 release. Until the fixed firmware is applied, compensating controls include disabling or restricting access to the device's HTTP/HTTPS management interface from the Wi-Fi/LAN side, isolating the router's management plane on a dedicated administrative SSID or VLAN, and blocking inbound traffic to the API port from untrusted clients (trade-off: legitimate mobile app management may break). Rotate or revoke any cached API tokens after upgrading, and monitor plan-creation logs for unexpected zero-cost plan entries as a detection signal for prior abuse.