Acer Connect M6E CVE-2026-50226

Q: What is the CVSS score of CVE-2026-50226?

CVE-2026-50226 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34231 MEDIUM

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-04 Acer

GHSA-phcf-76rm-q992

Authentication Bypass Connect M6E 5G Portable Wifi Router Acer

6.9

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 12:20 vuln.today

CVSS changed

Jun 04, 2026 - 10:22 NVD

6.9 (MEDIUM)

CVE Published

Jun 04, 2026 - 09:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.

AnalysisAI

Hardcoded AES-128-CBC cryptographic keys embedded in the AcerConnect OTA application allow unauthenticated remote attackers to forge authorization credentials for arbitrary IMEI numbers against the Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019). Once credentials are forged, attackers can enumerate OTA catalog items and retrieve protected firmware binaries via pre-signed cloud storage links. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the static nature of the hardcoded key means any actor who obtains the application binary can trivially reproduce the attack.

Technical ContextAI

CWE-321 (Use of Hard-coded Cryptographic Key) describes the root cause: the AcerConnect OTA update subsystem uses AES-128-CBC symmetric encryption with a key that is fixed at compile time and identical across all deployments. AES-128-CBC is a legitimate cipher, but its security guarantee collapses entirely when the key is embedded in the application, since anyone who decompiles or performs static analysis of the OTA client binary can recover it. The affected product is identified by CPE as cpe:2.3:a:acer:connect_m6e_5g_portable_wifi_router:*:*:*:*:*:*:*:*, covering all firmware versions up to M6E_AI_1.00.000019. The OTA mechanism interacts with a cloud backend using IMEI-scoped authorization, meaning the extracted key is sufficient to impersonate any device by supplying an arbitrary IMEI value, enabling cross-device catalog access and binary retrieval.

RemediationAI

Apply the firmware update released by Acer that supersedes M6E_AI_1.00.000019; the exact patched firmware version is not independently confirmed from the provided data - consult the Acer advisory directly at https://community.acer.com/en/kb/articles/19707 for the specific target version. The root fix must replace the static AES-128-CBC key with per-device or server-side dynamically generated credentials; simply updating the hardcoded key without architectural change only defers the problem. As a compensating control prior to patching, administrators can restrict outbound OTA traffic from the router to known Acer cloud endpoints via upstream firewall rules, limiting an attacker's ability to leverage forged credentials against the cloud backend - note this does not prevent key extraction from the binary itself, only reduces post-exploitation reach. No additional workaround eliminates the hardcoded key condition without a firmware update.