IDOR Vulnerability in Acer Summary Service Exposes Device Data
CVE-2026-49192

5.3MEDIUM

Key Information:

Vendor

Acer

Status
Connect M6e 5g Portable Wifi Router
Vendor
CVE Published:
4 June 2026

What is CVE-2026-49192?

The Acer Summary Service is susceptible to an IDOR vulnerability that arises from inadequate verification of user ownership for hardware serial numbers. This flaw allows unauthorized access to device data, potentially leading to data scraping and misuse. Users may unknowingly expose sensitive information due to this security oversight, necessitating immediate attention and remediation.

Affected Version(s)

Connect M6E 5G Portable WiFi Router *

References

https://community.acer.com/en/kb/articles/19707

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ta-Lun Yen
.