39
CVEs
11
Critical
21
High
0
KEV
0
PoC
32
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
21
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (30)
Connect M6E 5G Portable Wifi Router
26
Predator Connect W6X
5
Cr 48 Chromebook
3
Series 5 Chromebook
3
Ac700 Chromebook
3
Chrome Os
3
Chrome
3
Wave 7 Router
2
Care Center
2
Nitrorsense V3
2
Veriton X6620G Firmware
1
Aspire 1602M Firmware
1
Predatorsense V3
1
Extensa Ex215 21G Firmware
1
Veriton E430 Firmware
1
Aspire Z3 615 Firmware
1
Series 5 550 Chromebook
1
Ap130 F2 Firmware
1
Aspire Xc600 Firmware
1
Veriton M2611G Firmware
1
Veriton N2620G Firmware
1
Veriton X4620G Firmware
1
Altos W2000H W570H F4 Firmware
1
Aspire Xc100 Firmware
1
Aspire A115 21 Firmware
1
Chromebox 3
1
Veriton M4620 Firmware
1
Aspire Tc 120 Firmware
1
Veriton M2611 Firmware
1
Veriton S6620G Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-49199 | Remote unauthenticated command injection in the Acer Predator Connect W6x router enables root-level code execution via crafted MQTT messages, scoring a maximum 10.0 CVSS v4.0 across all impact metrics including subsequent system impact. The flaw was disclosed by Acer and tracked in the ENISA EUVD as EUVD-2026-33269, but no public exploit identified at time of analysis. Affects firmware W6x_GBL_2.00.000005 and earlier, with no special authentication or user interaction required. | CRITICAL | 10.0 | 0.7% | 51 |
No patch
|
| CVE-2026-49200 | Credential disclosure in the Acer Wave 7 router (firmware T7c_GBL_1.01.000055 and earlier) exposes the acer_cgi.log file over the web interface without authentication, leaking cleartext web and Telnet login credentials to any network-reachable attacker. With CVSS 4.0 of 10.0 and a vector indicating no privileges or user interaction, exploitation enables full device takeover; no public exploit identified at time of analysis, but the trivial nature of fetching a log file makes weaponization straightforward. | CRITICAL | 10.0 | 0.1% | 50 |
No patch
|
| CVE-2026-49185 | Unauthenticated remote command injection in Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) allows attackers to inject OS commands via the FieldX MDM adb messaging topic, which forwards unverified payloads to Runtime.exec(). The CVSS 4.0 score of 10.0 with network attack vector and no authentication required indicates a critical, trivially exploitable flaw; no public exploit identified at time of analysis but the simplicity of the bug pattern makes weaponization straightforward. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2026-49197 | Authentication bypass in Acer Predator Connect W6x routers (firmware W6x_GBL_2.00.000005 and earlier) allows remote unauthenticated attackers to reach app-facing web endpoints by sending an HTTP Authorization header whose Base64 payload is intentionally malformed, because the endpoint treats a decoding failure as a pass rather than a rejection. The CVSS 4.0 score of 10.0 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, availability impact on both vulnerable and subsequent systems) reflects full takeover potential against an internet-reachable consumer/SOHO router, though no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2026-49201 | Hardcoded AES encryption key in the upload.cgi binary of the Acer Wave 7 router (firmware T7c_GBL_1.01.000055 and earlier) allows remote unauthenticated attackers to decrypt, tamper with, and re-encrypt device backup files, enabling persistent backdoor injection on affected devices. The CVSS 4.0 score of 10.0 reflects full compromise of confidentiality, integrity, and availability across both the vulnerable component and downstream subsequent systems. No public exploit identified at time of analysis, and CISA SSVC reports exploitation status as 'none', though the issue is flagged as automatable with total technical impact. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2026-49190 | Command injection in the Acer Connect M6E 5G Portable WiFi Router allows authenticated remote attackers to install arbitrary applications or execute operating system commands by abusing internal operation codes (opcodes) whose permission checks are not properly enforced. The flaw carries a CVSS 4.0 score of 9.4 (Critical) due to network reach, low attack complexity, and scope-changing impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV. | CRITICAL | 9.4 | 0.1% | 47 |
No patch
|
| CVE-2026-49194 | Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router allows low-privileged remote attackers to reach a debug routine (SCREEN_CLICK opcode 5053) that skips the device login prompt and drops the caller directly into an interactive shell. CVSS 4.0 rates the issue 9.4 with scope change and high impact on confidentiality, integrity, and availability of both the router and connected subsystems; no public exploit identified at time of analysis. | CRITICAL | 9.4 | 0.0% | 47 |
No patch
|
| CVE-2026-49191 | Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router's M3WebServer production build exposes hard-coded backend API keys through verbose error pages, enabling remote unauthenticated attackers to harvest credentials and gain full administrative control over the device. CVSS 4.0 scores this 9.3 (Critical) with no privileges or user interaction required, though no public exploit has been identified at time of analysis. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-50214 | Authentication bypass in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤ M6E_AI_1.00.000019) allows remote attackers to abuse a hardcoded global API token guarding the /v1/Plan service, granting full administrative control over network access plans. Unauthenticated attackers can create arbitrary zero-cost plans, effectively bypassing billing and access controls. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects trivial network exploitability with no privileges or user interaction required. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-50209 | Privilege escalation via MDM endpoint hijack in the Acer Connect M6E 5G Portable WiFi Router (firmware ≤M6E_AI_1.00.000019) allows locally running malicious software to overwrite the default Mobile Device Management endpoint address through broadcast events, transferring administrative control of the device to an attacker-operated MDM server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-50208 | Cryptographic weaknesses in the Acer Connect M6E 5G Portable WiFi Router (firmware versions through M6E_AI_1.00.000019) combine TrustAllCerts routines that bypass TLS certificate validation with hard-coded DES symmetric encryption keys, enabling a network-positioned attacker to decrypt traffic between the device and its backend services. CVSS 4.0 rates this 9.2 (Critical) given the unauthenticated network attack surface and high confidentiality/integrity impact, though attack complexity is rated High due to the MITM positioning requirement. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.0% | 46 |
No patch
|
| CVE-2026-49202 | Unauthenticated exposure of internal multimedia session archives in the Acer Connect M6E 5G Portable WiFi Router lets remote attackers retrieve sensitive recorded session data, and overly permissive CORS rules amplify the issue by enabling cross-origin theft from any web context a victim visits. CVSS 4.0 rates this 8.8 (high) with network attack vector, no privileges, and no user interaction; no public exploit identified at time of analysis. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-50205 | Sensitive information disclosure in the Acer Connect M6E 5G Portable WiFi Router exposes cleartext SMTP authentication passwords and employee corporate identification data through system log files. With a CVSS 4.0 score of 8.8 (high confidentiality impact, network attack vector, no privileges or user interaction required) and no public exploit identified at time of analysis, the flaw enables remote attackers who can reach the log output to harvest credentials and PII without authentication. | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-50211 | Exposed factory diagnostics in Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) allow malicious applications to obtain write access to internal NVRAM registers, enabling persistent modification of device state and configuration. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.8 reflects high confidentiality and availability impact. The vulnerability was self-reported by Acer and is tracked in the EU vulnerability database as EUVD-2026-34223. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-50225 | Database flooding via unauthenticated abuse of Acer Connect M6E 5G Portable WiFi Router's registration endpoint allows remote attackers to exhaust storage by repeatedly invoking /v1/account/register without rate limiting, CAPTCHA, or other bot mitigation. The flaw affects firmware up to and including M6E_AI_1.00.000019 and carries a CVSS 4.0 score of 8.8 driven primarily by a high availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 8.8 | 0.0% | 44 |
No patch
|