CVE-2026-49192

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Acer	Connect M6E 5G Portable WiFi Router	<= M6E_AI_1.00.000019

References

https://community.acer.com/en/kb/articles/19707Mitigation, Vendor Advisory

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-491937.5Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.CVE-2026-491948.8The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an intera CVE-2026-491958.8Unauthenticated Debug Service. The /sbin/mtk_dut binary is exposed on TCP port 9000 without authentication, allowing any LAN-based attacker CVE-2026-491967.2The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.CVE-2026-491979.8Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 dec CVE-2026-491984.9Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.CVE-2026-491999.8Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.CVE-2026-49206.4The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to,CVE-2026-492009.8The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login CVE-2026-492019.8The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decryp CVE-2026-492028.6Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules CVE-2026-492038.3Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten