CVE-2026-49192

5.3 mediumEPSS 0.1%

Medium (5.3) in acer connect m6e 5g firmware. EPSS 0.1% chance of exploitation in the next 30 days.

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-06-04
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Affected

acer:connect_m6e_5g_firmware

References

https://community.acer.com/en/kb/articles/19707

Check your stack JSON