CVE-2026-49192

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://community.acer.com/en/kb/articles/19707	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:acer:connect_m6e_5g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:acer:connect_m6e_5g:-:*:*:*:*:*:*:*

History

04 Jun 2026, 19:39

Type	Values Removed	Values Added
References	~~() https://community.acer.com/en/kb/articles/19707 -~~	() https://community.acer.com/en/kb/articles/19707 - Mitigation, Vendor Advisory
First Time		Acer connect M6e 5g Firmware Acer connect M6e 5g Acer
CPE		cpe:2.3:o:acer:connect_m6e_5g_firmware:::::::: cpe:2.3:h:acer:connect_m6e_5g:-:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4

04 Jun 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-04 07:16

Updated : 2026-06-04 19:39

NVD link : CVE-2026-49192

Mitre link : CVE-2026-49192

CVE.ORG link : CVE-2026-49192

JSON object : View

Products Affected

acer

connect_m6e_5g_firmware
connect_m6e_5g

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-49192", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-06-04T07:16:27.153", "references": [{"url": "https://community.acer.com/en/kb/articles/19707", "tags": ["Mitigation", "Vendor Advisory"], "source": "8fc372e3-d9c5-46e4-9410-38469745c639"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping."}], "lastModified": "2026-06-04T19:39:27.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:connect_m6e_5g_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BBE818C-1578-47C8-A402-36D852468C7D", "versionEndIncluding": "m6e_ai_1.00.000019"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:connect_m6e_5g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "456D03CE-8030-467D-AD67-FA3202605157"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "8fc372e3-d9c5-46e4-9410-38469745c639"}