Which versions of Connect M6E 5G Portable Wifi Router are affected by EUVD-2026-34205?

Acer Connect M6E 5G routers enable unauthenticated root-level compromise for any WiFi-connected user, including guests and contractors, with no vendor patch currently available.

How to fix or mitigate EUVD-2026-34205?

Within 24 hours: Inventory all Acer Connect M6E 5G routers in production environments and verify firmware version against affected M6E_AI_1.00.000019 and earlier releases. Within 7 days: Implement network isolation-restrict WiFi access to authenticated users only, segment the affected WiFi network from corporate systems using firewall rules and VLAN separation, enable WPA3 encryption where available, and monitor Acer security advisories for patch releases. Within 30 days: Initiate procurement of replacement routers from vendors with demonstrated security patch track records, or prepare for immediate deployment once vendor releases and validates a firmware patch.

Connect M6E 5G Portable Wifi Router EUVD-2026-34205

Q: What is the CVSS score of EUVD-2026-34205?

EUVD-2026-34205 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-49188 HIGH

Active Debug Code (CWE-489)

2026-06-04 Acer

GHSA-9hqp-cgj3-526j

Information Disclosure Connect M6E 5G Portable Wifi Router

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 07:45 vuln.today

CVSS changed

Jun 04, 2026 - 06:22 NVD

8.7 (HIGH)

CVE Published

Jun 04, 2026 - 04:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.

AnalysisAI

Unauthenticated root command execution affects the Acer Connect M6E 5G Portable WiFi Router through firmware M6E_AI_1.00.000019, where the ai_cmd utility runs with root privileges and passes socket input directly to popen(). Adjacent-network attackers (anyone on the WiFi or LAN segment) can issue arbitrary shell commands as root with no authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory all Acer Connect M6E 5G routers in production environments and verify firmware version against affected M6E_AI_1.00.000019 and earlier releases. …

Threat intelligence, references, and detailed analysis are available after sign-in.