EUVD-2026-34230
GHSA-82fg-pv3h-fmhc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAssociate to M6E WLAN or reach management API
-
DeliveryEnumerate /v1/account/register endpoint
-
ExploitScript high-volume POST requests with randomized accounts
-
ExecutionBypass absent bot mitigation
-
PersistFlood router account database
-
ImpactDegrade or deny registration and device availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Network reachability to the router's HTTP management API endpoint /v1/account/register is required - in typical deployments this means the attacker must be associated with the M6E's WLAN or otherwise on a network path to the device's management interface; no credentials, no user interaction, and no special server-side configuration are required because the endpoint ships without any rate limiting, CAPTCHA, or bot mitigation. Limiting factors: the M6E is a portable battery-powered router rather than an always-on internet-facing service, so exposure is usually constrained to whoever is on the device's Wi-Fi or to deployments that explicitly enable remote/cloud management; firmware must be at or below M6E_AI_1.00.000019. |
| Impact | Signals partially conflict. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a trivially reachable, unauthenticated, low-complexity attack with HIGH availability impact (VA:H), supporting an 8.8 base score. However, the real-world attack surface is narrower than a typical 8.8: the M6E is a portable consumer WiFi router whose management/registration API is normally reachable only by clients on the device's own LAN/WLAN - internet exposure depends on whether the user enables remote/cloud management. EPSS data is not provided, the CVE is not in CISA KEV, and no public POC is referenced, suggesting opportunistic rather than mass exploitation. The vendor tag 'Authentication Bypass' and CWE-306 framing slightly overstate the impact - the description describes resource abuse via missing bot mitigation, not authentication bypass leading to compromise; verify scope with Acer before treating this as a credential/auth flaw. |
| Exploit ScenarioDerived | An attacker on the same WLAN as a Connect M6E (or reaching it via any exposed management path) scripts repeated HTTP POSTs to /v1/account/register with randomized payloads, inserting thousands of bogus account records per minute. Within minutes the router's account/user storage fills, causing degraded or failed legitimate registrations, web-UI errors, or device instability; no public POC is referenced but the request is trivial to reproduce with curl or a short script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 04, 2026
Database flooding via unauthenticated abuse of Acer Connect M6E 5G Portable WiFi Router's registration endpoint allows remote attackers to exhaust storage by repeatedly invoking /v1/account/register without rate limiting, CAPTCHA, or other bot mitigation. The flaw affects firmware up to and including M6E_AI_1.00.000019 and carries a CVSS 4.0 score of 8.8 driven primarily by a high availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis from the provided data; the Acer community KB article at https://community.acer.com/en/kb/articles/19707 should be consulted for the current fixed firmware build superseding M6E_AI_1.00.000019, and the device updated via its built-in firmware update mechanism. Until a fixed build is applied, compensating controls include disabling any remote/WAN-side management or cloud-portal exposure of the router's HTTP API so /v1/account/register is reachable only from the local WLAN (side effect: loss of remote administration), restricting WLAN access to trusted clients via WPA2/WPA3 with a strong PSK (side effect: limits guest usage), and where supported, placing the management interface behind a firewall ACL that blocks external sources (side effect: requires manual unblock for legitimate remote admin). Avoid leaving the device with a default or weak Wi-Fi password since LAN-side reachability is sufficient to abuse this endpoint.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Acer Connect M6E is a 5G mobile/portable WiFi router exposing an HTTP management/account API. The vulnerable endpoint /v1/account/register sits in the user-account provisioning path and is reachable without prior authentication. Mapped to CWE-306 (Missing Authentication for Critical Function) - though here the root issue is more precisely the absence of anti-automation controls (rate limiting, CAPTCHA, proof-of-work, or device-binding) on a state-changing, write-heavy endpoint, allowing a single client to insert unbounded records into the router's account/user store. The affected CPE is cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router and ENISA EUVD-2026-34230 confirms scope.
Know when Connect M6E 5G Portable Wifi Router gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (Acer) · only source for this CVE.
CVSS VectorVendor: Acer
Lifecycle Timeline
2DescriptionCVE.org
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.
Executive ViewAI
Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) contains an unauthenticated denial-of-service vulnerability that allows remote attackers to exhaust device storage and disrupt service with minimal technical effort. No public exploit identified at time of analysis; however, the absence of authentication, rate limiting, or CAPTCHA creates substantial risk for any internet-facing deployment. Organizations relying on these devices for mobile or branch connectivity face unpredictable service loss without available patches.
No vendor-released patch identified at time of analysis. Until patch availability: implement network-level rate limiting on /v1/account/register endpoint; disable the registration feature if operationally feasible; isolate affected devices on restricted network segments with egress filtering; deploy monitoring to detect registration request flooding patterns; prioritize device replacement in hardware refresh cycle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote command injection in Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) all
Command injection in the Acer Connect M6E 5G Portable WiFi Router allows authenticated remote attackers to install arbit
Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router allows low-privileged remote attackers to reach a
Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router's M3WebServer production build exposes hard-coded
Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) allows remote atta
Privilege escalation via MDM endpoint hijack in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤M6E_AI_1.00.0000
Cryptographic weaknesses in the Acer Connect M6E 5G Portable WiFi Router (firmware versions through M6E_AI_1.00.000019)
Sensitive information disclosure in the Acer Connect M6E 5G Portable WiFi Router exposes cleartext SMTP authentication p
Unauthenticated exposure of internal multimedia session archives in the Acer Connect M6E 5G Portable WiFi Router lets re
Exposed factory diagnostics in Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) allow
Public exposure of telemetry data affects Acer Connect M6E 5G Portable WiFi Router, where misconfigured cloud storage co
Information disclosure in the Acer Connect M6E 5G Portable WiFi Router (firmware versions up to and including M6E_AI_1.0
Exploit-DB