API Key Exposure in M3WebServer by Acer
CVE-2026-49191

9.3CRITICAL

Key Information:

Vendor

Acer

Status
Connect M6e 5g Portable Wifi Router
Vendor
CVE Published:
4 June 2026

What is CVE-2026-49191?

The production build of M3WebServer contains a significant vulnerability due to the hard-coded backend API keys. These keys can be intercepted by attackers through verbose error handling pages, which may expose sensitive information and compromise the integrity of the server. Organizations using this product should take immediate steps to ensure that their configurations do not allow for error message verbosity, and they should consider implementing secure key management practices.

Affected Version(s)

Connect M6E 5G Portable WiFi Router *

References

https://community.acer.com/en/kb/articles/19707

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ta-Lun Yen
.