Acer Connect M6E CVE-2026-50224

Q: What is the CVSS score of CVE-2026-50224?

CVE-2026-50224 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34229 MEDIUM

Information Exposure (CWE-200)

2026-06-04 Acer

GHSA-569c-634x-7vch

Information Disclosure Connect M6E 5G Portable Wifi Router Acer

6.9

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 12:22 vuln.today

CVSS changed

Jun 04, 2026 - 10:22 NVD

6.9 (MEDIUM)

CVE Published

Jun 04, 2026 - 09:26 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.

AnalysisAI

The web administration panel of the Acer Connect M6E 5G Portable WiFi Router binds to the wildcard IPv6 address [::] on port 8080, exposing internal API endpoints over the public WAN interface without default firewall restrictions. All firmware versions through M6E_AI_1.00.000019 are affected, enabling authenticated remote attackers with high-privilege credentials to reach and query administrative APIs that are intended to be LAN-restricted only. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the design flaw structurally expands the attack surface for any admin-level compromise.

Technical ContextAI

The router's embedded web server binds to the wildcard IPv6 socket address [::] on port 8080, which instructs the OS to accept connections on all IPv6-capable network interfaces simultaneously - including the carrier-assigned global unicast WAN interface. This contrasts with the intended behavior of binding only to link-local or LAN-side interfaces (e.g., fe80:: or the LAN bridge). The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the application fails to restrict network interface scope, causing internal administrative API endpoints to be reachable from arbitrary WAN-side hosts. The affected product is confirmed by CPE string cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router:*:*:*:*:*:*:*:*, covering all firmware builds at or below M6E_AI_1.00.000019 as documented under ENISA EUVD-2026-34229.

RemediationAI

Consult the Acer advisory at https://community.acer.com/en/kb/articles/19707 for firmware update guidance. The affected version ceiling of M6E_AI_1.00.000019 implies a patched firmware release exists, but the exact fixed version number is not independently confirmed from available input data - verify the specific update version directly from the Acer advisory before deploying. As compensating controls pending firmware update: apply an ACL or firewall rule at the upstream carrier, CPE router, or network perimeter to block inbound TCP port 8080 to the device's public IPv6 address, which prevents WAN-side access to the admin panel without disrupting LAN functionality. Alternatively, disable IPv6 WAN connectivity on the device entirely if not operationally required, though this will prevent IPv6-only services from functioning. Do not rely on obscurity of the IPv6 address as a control, as IPv6 scanning tools can enumerate carrier prefixes.