API Token Vulnerability in Acer Network Management Services
CVE-2026-50214

9.3CRITICAL

Key Information:

Vendor

Acer

Status
Connect M6e 5g Portable Wifi Router
Vendor
CVE Published:
4 June 2026

What is CVE-2026-50214?

The /v1/Plan service provided by Acer relies on a single global API token for complete administrative control. This design flaw permits unauthorized users to create zero-cost network access plans, leading to significant security risks. Attackers can exploit this vulnerability to gain full administrative privileges and manipulate network configurations without proper authorization.

Affected Version(s)

Connect M6E 5G Portable WiFi Router *

References

https://community.acer.com/en/kb/articles/19707

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ta-Lun Yen
.