Acer Connect M6E EUVD-2026-34228

Exploitation requires network reachability to the Acer Connect M6E's /v1/Plan management endpoint and knowledge (or recovery) of the shared global API token embedded for administrative use; no per-user credentials, MFA, user interaction, or non-default configuration is needed because the token is the sole authentication factor on a default-enabled service. Limiting factors: the attacker must be able to route to the router's API interface (typically the LAN/Wi-Fi side of a portable hotspot rather than the 5G WAN, though the advisory does not explicitly confirm interface scope), and the device must be running firmware at or below M6E_AI_1.00.000019. Once the token is obtained from firmware, the mobile companion app, or passive observation, exploitation is unauthenticated from the API's perspective and fully automatable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact on the vulnerable component - a textbook critical finding. EPSS, KEV status, and SSVC decision data were not provided, so probabilistic exploitation signals are unknown; absence of CISA KEV listing means there is no public confirmation of active exploitation. The vendor's own tag of 'Information Disclosure' under-states the true impact, since the description clearly describes administrative write access (plan creation), not just read access - defenders should treat this as full management-plane compromise of the router's plan service. A key caveat: the description does not specify whether the /v1/Plan service is reachable from the WAN/5G interface or only from the LAN/Wi-Fi side; if LAN-only, real-world exposure narrows to attackers already on the hotspot's Wi-Fi. Verify reachability with Acer before downgrading priority.

An attacker associated to (or otherwise able to reach) the Acer Connect M6E's management API extracts the hardcoded global API token - for example by reverse-engineering the companion mobile app or sniffing a legitimate session - and sends crafted POSTs to /v1/Plan to provision unlimited zero-cost access plans for themselves or others. This effectively yields free 5G connectivity and undermines any quota, billing, or access-control logic the device enforces. No public exploit identified at time of analysis, but the flaw is trivially scriptable once the shared token is known.