Acer Connect M6E EUVD-2026-34221

Attacker must already have low-privileged code execution on the Acer Connect M6E 5G Portable WiFi Router running firmware ≤M6E_AI_1.00.000019 (e.g., via a malicious installed application), because the attack vector is local (AV:L) and broadcast events are an on-device IPC mechanism. The vulnerable feature is specifically the MDM endpoint configuration writable through broadcast events without adequate permission gating; exploitation does not require user interaction (UI:N) or special attack requirements (AT:N), and complexity is low (AC:L). Limiting factors: no network-reachable attack surface, the router must be MDM-managed for the takeover to translate into meaningful administrative control of downstream policy, and the attacker needs a delivery mechanism for the malicious component onto the device.

The CVSS 4.0 base score of 9.3 reflects local attack vector (AV:L) with low complexity (AC:L), low required privileges (PR:L), and no user interaction (UI:N), combined with high confidentiality/integrity/availability impact on both the vulnerable system and subsequent systems (the latter capturing the downstream takeover of administered devices via the new MDM channel). Real-world prioritization is more nuanced: AV:L means an attacker must already have code execution or an installed app on the device, which is a meaningful precondition for a consumer hotspot, lowering opportunistic exploitation likelihood. EPSS and CISA KEV status are not provided in the input, and no public PoC is referenced, so this analysis treats the issue as no public exploit identified at time of analysis. Severity is genuinely high for fleets where the M6E is centrally MDM-managed, because successful exploitation pivots administrative ownership to an attacker and transitively compromises the integrity of downstream policy/config pushes (reflected in SC:H/SI:H/SA:H).

An attacker convinces a user to install a malicious application on the M6E router (or otherwise achieves low-privilege code execution on the device), and that application emits the specific broadcast event that overwrites the configured MDM server URL with an attacker-controlled endpoint. On the next MDM check-in, the router enrolls against the attacker's server and accepts subsequent configuration, credential, and firmware-policy commands as authoritative, completing the administrative takeover; no public PoC is referenced in the available data.