Acer Connect M6E CVE-2026-50224

Exploitation requires three concurrent conditions: (1) the device must have a publicly routable global unicast IPv6 WAN address assigned by the carrier or ISP - devices behind IPv4 NAT without IPv6 WAN are not affected via this path; (2) no upstream firewall, carrier-grade ACL, or network perimeter control must be blocking inbound TCP port 8080 to the device's IPv6 address; and (3) the attacker must possess or obtain high-privilege administrative credentials for the web panel, as confirmed by PR:H in the CVSS 4.0 vector - port reachability alone does not yield sensitive data without authentication. The CVSS VI:N and VA:N metrics confirm that even successful exploitation does not allow modification of data or disruption of service, limiting impact to information disclosure. Devices deployed without IPv6 WAN, or protected by upstream IPv6 packet filtering on port 8080, are not exposed.

The CVSS 4.0 score of 6.9 (Medium) is driven by network accessibility (AV:N), low attack complexity (AC:L), and no required attack prerequisites (AT:N), but is moderated significantly by the high-privilege requirement (PR:H), yielding high confidentiality impact (VC:H) with zero integrity or availability impact. This vector correctly captures that admin credentials are required to extract sensitive data - bare port reachability does not yield exploitation on its own. No EPSS data was supplied, so exploitation probability cannot be quantified. Absence of a KEV listing and no identified public exploit code suggest opportunistic mass exploitation is unlikely. Real-world risk is nonetheless meaningful for device owners with active IPv6 WAN connectivity and no upstream firewall: the admin panel being internet-facing enables credential brute-force or stuffing attacks that were previously LAN-restricted by network topology, and any admin credential compromise now results in WAN-reachable sensitive data exposure rather than just local.

An attacker enumerates a carrier's IPv6 prefix space, identifies a reachable Acer Connect M6E device by probing port 8080 for the admin panel's HTTP response fingerprint, and then performs credential stuffing using default or previously leaked admin credentials. With high-privilege credentials in hand, the attacker queries internal API endpoints - previously unreachable from WAN under a correct binding configuration - and extracts sensitive device configuration, network topology, or credential data. No public exploit code has been identified, making this scenario more likely in targeted rather than opportunistic attacks.