CVE-2026-50214
A critical flaw in Acer Connect M6E 5G firmware allows anyone with the shared global API token to create unlimited zero‑cost network access plans. The vulnerability is due to the /v1/Plan service relying entirely on that token for full administrative control.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Acer Connect M6E 5G firmware and the device itself, used by network administrators managing the device’s access plans.
Real-world impact
An attacker who obtains the shared API token can create unlimited free network access plans, potentially granting unauthorized users network access without cost or oversight.
Why this severity
The CVSS score of 9.3 reflects the high impact on confidentiality, integrity, and availability: the flaw allows complete administrative control, enabling an attacker to modify or create network access plans at will.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- community.acer.com/en/kb/articles/19707mitigationvendor advisory