Acer Connect M6E EUVD-2026-34223

Exploitation requires the target device to be running Acer Connect M6E firmware M6E_AI_1.00.000019 or earlier with the un-stripped factory and engineering diagnostic interfaces present on the retail build, and a malicious application with reach into the device's diagnostic channel must be running - per the description, exploitation is performed by 'malicious apps' that gain write access to internal NVRAM registers, not by an arbitrary remote internet host. The CVSS 4.0 vector lists PR:N and AV:N, but the description's wording implies the attacker must first achieve app-level presence on or adjacent to the router, so the network-vector reading should be verified with Acer; this is a meaningful limiting factor for defenders prioritizing the issue.

Signals are mixed and partially contradictory. The CVSS 4.0 vector advertises AV:N/AC:L/PR:N/UI:N, implying an unauthenticated network-reachable attack with no user interaction, yet the description explicitly says exploitation is performed by 'malicious apps' on the device - a profile that more closely matches a local attack vector requiring prior code execution or app installation on the router (or a paired client). This inconsistency should be verified with Acer before treating the issue as remotely exploitable. There is no EPSS score, no POC, and no CISA KEV listing provided, so this is best assessed as a latent supply-chain hygiene issue with high potential impact (persistent NVRAM tampering) but unclear real-world exploitability until the attack vector is clarified. Treat as a medium-priority firmware update for affected fleets, escalating only if the network-vector reading is confirmed.

A malicious mobile application installed on a device that interacts with the router - for example through the vendor management app channel - locates the leftover engineering diagnostic endpoints exposed by retail firmware and issues diagnostic commands that write attacker-controlled values into NVRAM. The attacker uses this primitive to alter persistent configuration such as DNS, admin credentials, or boot parameters, surviving reboots and factory resets that read from the tampered NVRAM region. No public exploit identified at time of analysis.