EUVD-2026-34229
GHSA-569c-634x-7vch
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.
AnalysisAI
The web administration panel of the Acer Connect M6E 5G Portable WiFi Router binds to the wildcard IPv6 address [::] on port 8080, exposing internal API endpoints over the public WAN interface without default firewall restrictions. All firmware versions through M6E_AI_1.00.000019 are affected, enabling authenticated remote attackers with high-privilege credentials to reach and query administrative APIs that are intended to be LAN-restricted only. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the device must have a publicly routable global unicast IPv6 WAN address assigned by the carrier or ISP - devices behind IPv4 NAT without IPv6 WAN are not affected via this path; (2) no upstream firewall, carrier-grade ACL, or network perimeter control must be blocking inbound TCP port 8080 to the device's IPv6 address; and (3) the attacker must possess or obtain high-privilege administrative credentials for the web panel, as confirmed by PR:H in the CVSS 4.0 vector - port reachability alone does not yield sensitive data without authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 (Medium) is driven by network accessibility (AV:N), low attack complexity (AC:L), and no required attack prerequisites (AT:N), but is moderated significantly by the high-privilege requirement (PR:H), yielding high confidentiality impact (VC:H) with zero integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates a carrier's IPv6 prefix space, identifies a reachable Acer Connect M6E device by probing port 8080 for the admin panel's HTTP response fingerprint, and then performs credential stuffing using default or previously leaked admin credentials. With high-privilege credentials in hand, the attacker queries internal API endpoints - previously unreachable from WAN under a correct binding configuration - and extracts sensitive device configuration, network topology, or credential data. … |
| Remediation | Consult the Acer advisory at https://community.acer.com/en/kb/articles/19707 for firmware update guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote command injection in Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) all
Command injection in the Acer Connect M6E 5G Portable WiFi Router allows authenticated remote attackers to install arbit
Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router allows low-privileged remote attackers to reach a
Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router's M3WebServer production build exposes hard-coded
Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) allows remote atta
Privilege escalation via MDM endpoint hijack in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤M6E_AI_1.00.0000
Cryptographic weaknesses in the Acer Connect M6E 5G Portable WiFi Router (firmware versions through M6E_AI_1.00.000019)
Sensitive information disclosure in the Acer Connect M6E 5G Portable WiFi Router exposes cleartext SMTP authentication p
Unauthenticated exposure of internal multimedia session archives in the Acer Connect M6E 5G Portable WiFi Router lets re
Exposed factory diagnostics in Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) allow
Database flooding via unauthenticated abuse of Acer Connect M6E 5G Portable WiFi Router's registration endpoint allows r
Public exposure of telemetry data affects Acer Connect M6E 5G Portable WiFi Router, where misconfigured cloud storage co
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today