Acer Connect M6E EUVD-2026-34211

The attacker must hold a valid authenticated account on the Acer Connect M6E summary service (PR:L per CVSS vector) - unauthenticated exploitation is not supported by available data. Once authenticated, no special device configuration, non-default settings, or elevated privileges are required; the IDOR exists in the default API behavior for all versions covered by the wildcard CPE. The attack is fully network-accessible (AV:N) with no user interaction (UI:N) and low complexity (AC:L). The primary limiting factor is the ability to obtain or enumerate valid hardware serial numbers of other devices; consumer hardware serial numbers are frequently predictable or follow enumerable patterns, reducing this barrier significantly. Exploitation is constrained to device data retrieval - the CVSS vector indicates low integrity (VI:L) and availability (VA:L) impact rather than full system compromise or code execution.

The CVSS 4.0 score of 5.3 (Medium) is broadly consistent with the described impact: authenticated network exploitation with low complexity, no user interaction, and limited per-device impact. The CVSS vector assigns PR:L, confirming an authenticated session is required, which excludes unauthenticated threat actors and limits opportunistic mass exploitation. However, the VC:N assignment (no confidentiality impact on the vulnerable system) is notably inconsistent with the described behavior of exposing device data belonging to other users - this conflict should be verified with Acer, as the score may understate information disclosure risk. No EPSS score was provided in available data, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The primary real-world risk is bulk scraping of device telemetry across the Acer Connect M6E user base by any authenticated account holder, particularly if serial numbers follow predictable patterns. This is a moderate-priority finding for Acer's platform team rather than an emergency zero-day scenario for end users.

An attacker with a valid Acer Connect M6E service account sends crafted requests to the summary service endpoint, substituting their own device's serial number with sequentially guessed or enumerated serial numbers belonging to other devices. Because the endpoint returns data for any valid serial number regardless of ownership, the attacker iterates through the identifier space and collects device telemetry or configuration data for arbitrary devices in the user population. No public exploit code has been identified at time of analysis, but the low attack complexity and lack of ownership enforcement make manual exploitation straightforward for any authenticated user.