Paper/Archive/CVE-2026-49190

CVE-2026-49190

Acer Connect M6E 5G Portable WiFi Router — Missing Per-Instruction Authorization Checks

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 36.9.369 × 207.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.

Affected

ProductAffectedFixed inSource

Connect M6E 5G Portable WiFi Router≤ M6E_AI_1.00.000019–CNA

Scores by source

Acer (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.acer.com/en/kb/articles/19707