CVE-2026-49191
A critical flaw in Acer’s Connect M6E 5G firmware allows attackers to capture hard‑coded backend API keys. The vulnerability is triggered by verbose error pages that expose the keys. If exploited, an attacker could gain full control over the device’s backend services.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Acer Connect M6E 5G firmware and the device itself (CPE: acer connect_m6e_5g_firmware, acer connect_m6e_5g).
Real-world impact
An attacker could read the exposed API keys, use them to authenticate to the device’s backend, and then control or manipulate the device’s functions, potentially compromising network traffic or data.
Why this severity
The CVSS score of 9.3 reflects that the flaw gives attackers complete confidentiality, integrity, and availability compromise with no need for authentication or special privileges, and can be exploited remotely with minimal effort.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- community.acer.com/en/kb/articles/19707mitigationvendor advisory