CVE-2026-49203

7.2 highEPSS 0.2%

High (7.2) in acer connect m6e 5g firmware. EPSS 0.2% chance of exploitation in the next 30 days.

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

Severity

CVSS 4.0

7.2 high

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.3 high

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2026-06-04
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Affected

acer:connect_m6e_5g_firmware

References

https://community.acer.com/en/kb/articles/19707

Check your stack JSON