Acer Connect M6E EUVD-2026-34220

Exploitation requires that the attacker achieve a Man-in-the-Middle network position on a path used by the Acer Connect M6E 5G Portable WiFi Router's outbound TLS traffic - for example, control of an upstream Wi-Fi access point, ARP/DHCP spoofing on the LAN segment the router connects through, BGP/routing manipulation, or a malicious carrier/transit path. The hard-coded DES key must also be extracted from the firmware image (Acer Connect M6E firmware ≤ M6E_AI_1.00.000019) for the cryptographic decryption component; this is a one-time effort per attacker. No authentication to the device itself is required (PR:N) and no user interaction is needed (UI:N), but the High Attack Complexity (AC:H) reflects the genuine MITM-positioning prerequisite. The vulnerability is limited to this specific Acer product line and firmware range; users who never connect the router to untrusted networks face substantially reduced practical exposure.

The signals are mixed and warrant careful interpretation. The CVSS 4.0 base score of 9.2 reflects network attack vector, no privileges, and high impact on confidentiality and integrity - but Attack Complexity is High (AC:H), reflecting the genuine prerequisite of obtaining a MITM position on the network path. EPSS and KEV data are not provided in the input, and no public exploit has been identified at time of analysis, so this appears to be a vendor-disclosed issue rather than one under active exploitation. Realistic risk is highest for users on untrusted networks (public Wi-Fi, hostile carriers, hotel networks) where MITM positioning is trivially achievable - a common scenario for a portable travel router. For users on trusted home networks the practical exposure is lower, but the hard-coded DES key means that any captured traffic (even retroactively) is decryptable once the key is extracted, making this a pre-positioning and bulk-collection risk as well as a real-time one.

An attacker on the same Wi-Fi network as the router, on the upstream carrier path, or in any intermediate network position intercepts the device's outbound TLS connections to Acer cloud/management endpoints. Because TrustAllCerts disables certificate validation, the attacker's substituted certificate is accepted silently; any application-layer traffic protected only by the hard-coded DES key can then be decrypted offline using the key extracted from a sibling device's firmware. No public exploit is identified at time of analysis, but both primitives (TrustAllCerts bypass and DES key extraction) are well-understood and trivial to weaponize once the firmware is reverse-engineered.