Acer Connect M6E EUVD-2026-34209

The attacker must have network reachability to the router's management plane (typically the LAN/Wi-Fi side of an Acer Connect M6E, or the WAN side if remote administration has been enabled) and must hold low-privileged credentials on the device (CVSS PR:L) - fully unauthenticated access is not indicated by the vector. No user interaction is required (UI:N) and attack complexity is low (AC:L). The specific limiting factor stated in the description is that exploitation works through 'multiple internal operation codes (opcodes)' whose permission evaluation is broken, so the attacker must be able to invoke the device's opcode-based management interface (e.g., the proprietary admin API exposed by the M6E firmware) rather than only the regular HTTP UI. The vulnerability is constrained to the Acer Connect M6E 5G Portable WiFi Router product line.

Signals are mostly aligned toward high real-world risk: CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and a changed scope (SC:H/SI:H/SA:H) describes a network-reachable, low-complexity, no-interaction command injection achievable with only low privileges, which on a consumer router often equates to an ordinary management account or a guest-network foothold. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified - the only confirmed exploitation signal is the vendor's own disclosure. A notable caveat is that 'network' in CVSS for a portable router typically means the local LAN/Wi-Fi or the router's WAN-side management interface if exposed; if the management plane is bound only to the LAN by default, real-world reach is narrower than AV:N alone suggests. Treat as a high-priority patch target for any fleet using the M6E, but verify exposure of the admin interface before assuming internet-wide risk.

An attacker with low-privileged access to the router's management interface - for example, a guest Wi-Fi user, a compromised LAN host, or someone with a captured non-admin account - sends a crafted request invoking one of the unprotected opcodes and supplies shell metacharacters in a parameter that is concatenated into an OS command. The router executes the injected command in the firmware's command interpreter, allowing the attacker to install a backdoor application or run arbitrary system commands as the service account, pivoting to full device takeover and a foothold on the local network.