Acer Connect M6E EUVD-2026-34215

The victim must be using or connected to an Acer Connect M6E 5G Portable WiFi Router with the internal multimedia session archive feature in use (so archived content exists to steal), and the attacker needs network reach to the router's management/media interface - typically same-Wi-Fi clients, or a browser-based attacker if the victim visits an attacker-controlled site while connected. The CVSS vector (PR:N, UI:N) indicates no authentication and no user interaction are required for the direct network path; the CORS-based cross-site theft variant additionally requires the victim to load attacker-controlled web content in a browser on a device with reach to the router. Exploitation is limited to deployments where the vulnerable endpoint is reachable (likely LAN-side by default) and where multimedia session archives have actually been recorded.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact, which aligns with the description of unauthenticated archive access. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use cannot be quantified; no public exploit identified at time of analysis. The realistic priority is moderate-to-high for owners of this specific consumer/SMB router because the device is typically deployed on hostile networks (cafes, hotels, travel), but worldwide impact is bounded by installed base and by whether the management interface is reachable beyond the LAN - the description does not clarify whether the vulnerable endpoint is exposed on the WAN side or only the LAN/Wi-Fi side, which materially changes risk and should be verified with Acer's advisory.

A traveler connects their laptop to an Acer Connect M6E and then browses an attacker-controlled webpage; JavaScript on that page issues fetch() requests to the router's internal multimedia session archive endpoint, and because there is no authentication and CORS permits the cross-origin read, the attacker silently exfiltrates the archived session contents to their own server. Alternatively, any other client on the same Wi-Fi can request the archive endpoint directly with no credentials.