Which versions of Acer Connect M6E are affected by CVE-2026-50225?

Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) contains an unauthenticated denial-of-service vulnerability that allows remote attackers to exhaust device storage…

How to fix or mitigate CVE-2026-50225?

Within 24 hours: Inventory all Acer Connect M6E 5G routers in production and document firmware versions; assess whether devices are internet-accessible or used in security-sensitive roles. Within 7 days: Deploy network-level rate limiting on the /v1/account/register endpoint for all affected devices; open vendor support case with Acer to request patch timeline and interim mitigation guidance. Within 30 days: If no vendor patch is released, develop transition plan to alternative 5G/WiFi solutions; retire affected devices or document risk acceptance in writing.

Acer Connect M6E CVE-2026-50225

Q: What is the CVSS score of CVE-2026-50225?

CVE-2026-50225 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34230 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-04 Acer

GHSA-82fg-pv3h-fmhc

Authentication Bypass Connect M6E 5G Portable Wifi Router

8.8

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 12:20 vuln.today

CVSS changed

Jun 04, 2026 - 10:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 09:29 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.

AnalysisAI

Database flooding via unauthenticated abuse of Acer Connect M6E 5G Portable WiFi Router's registration endpoint allows remote attackers to exhaust storage by repeatedly invoking /v1/account/register without rate limiting, CAPTCHA, or other bot mitigation. The flaw affects firmware up to and including M6E_AI_1.00.000019 and carries a CVSS 4.0 score of 8.8 driven primarily by a high availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The Acer Connect M6E is a 5G mobile/portable WiFi router exposing an HTTP management/account API. The vulnerable endpoint /v1/account/register sits in the user-account provisioning path and is reachable without prior authentication. Mapped to CWE-306 (Missing Authentication for Critical Function) - though here the root issue is more precisely the absence of anti-automation controls (rate limiting, CAPTCHA, proof-of-work, or device-binding) on a state-changing, write-heavy endpoint, allowing a single client to insert unbounded records into the router's account/user store. The affected CPE is cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router and ENISA EUVD-2026-34230 confirms scope.

RemediationAI

No vendor-released patch version is identified at time of analysis from the provided data; the Acer community KB article at https://community.acer.com/en/kb/articles/19707 should be consulted for the current fixed firmware build superseding M6E_AI_1.00.000019, and the device updated via its built-in firmware update mechanism. Until a fixed build is applied, compensating controls include disabling any remote/WAN-side management or cloud-portal exposure of the router's HTTP API so /v1/account/register is reachable only from the local WLAN (side effect: loss of remote administration), restricting WLAN access to trusted clients via WPA2/WPA3 with a strong PSK (side effect: limits guest usage), and where supported, placing the management interface behind a firewall ACL that blocks external sources (side effect: requires manual unblock for legitimate remote admin). Avoid leaving the device with a default or weak Wi-Fi password since LAN-side reachability is sufficient to abuse this endpoint.