CVE-2026-49193: Acer Connect M6E 5G Cloud Storage Telemetry Exposure (CVSS 7.5)

Technical summary

The vulnerability stems from improper access control configuration on cloud storage containers associated with Acer Connect M6E 5G devices and firmware. Active telemetry data—which may include device metrics, usage statistics, and operational information—is stored in cloud containers with overly permissive permissions, allowing unauthenticated, anonymous access from the internet. This is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The CVSS 3.1 score of 7.5 reflects a network-exploitable vulnerability requiring no authentication or user interaction, with high confidentiality impact but no integrity or availability impact.

Business impact

Exposure of device telemetry can reveal operational patterns, network behavior, and usage trends. In enterprise deployments, this could disclose information about fleet health, deployment scale, and traffic patterns. For service providers, it may expose end-customer usage metrics. While immediate device compromise is unlikely, the intelligence gathered could inform social engineering, network reconnaissance, or targeted attacks. Compliance implications depend on whether telemetry includes personal or regulated data; GDPR, HIPAA, or industry-specific regulations may be triggered if health or customer data is present in the telemetry stream.

Affected systems

The vulnerability affects Acer Connect M6E 5G devices and their associated firmware. Any deployment of these devices that transmits telemetry to cloud storage with default or misconfigured access policies is at risk. Both consumer and enterprise deployments should be assessed for exposure.

Exploitability

Exploitation is straightforward: the vulnerability requires only network access and no authentication. An attacker can directly access the cloud storage containers if they are enumerable or if URLs are discoverable via common cloud storage scanning techniques. The barrier to exploitation is low, though the attacker must first identify the exposed container. This is not currently listed on the CISA Known Exploited Vulnerabilities catalog, but the low barrier to discovery and exploitation suggests monitoring is warranted.

Remediation

Restrict cloud storage container access by implementing least-privilege access controls. Verify that telemetry data is not publicly readable; configure containers to require authentication and limit access to authorized services and administrators only. Acer should issue updated firmware and configuration guidance that defaults to private or restricted container settings. Organizations should audit their Acer Connect M6E 5G deployments and apply any available patches or configuration updates from Acer immediately.

Patch guidance

Check the Acer support portal for firmware updates to Acer Connect M6E 5G devices. Updates should address cloud storage permission policies and telemetry data access controls. Apply patches to all affected devices in your environment. Until patches are available, implement compensating controls by restricting cloud storage permissions and applying network segmentation to limit telemetry data exposure. Verify against the official Acer advisory for specific firmware version numbers and remediation steps.

Detection guidance

Audit cloud storage containers associated with Acer Connect M6E 5G devices for public or overly permissive access policies. Review access logs for unauthorized read attempts on telemetry data. Monitor for unusual enumeration or scanning activity targeting cloud storage endpoints. Implement alerting on cloud storage permission changes and unauthorized access attempts. Network monitoring can detect exfiltration of telemetry data if egress controls are in place.

Why prioritize this

This vulnerability merits high priority because it enables direct, unauthenticated disclosure of operational data with minimal exploitation barriers. Although no active exploitation has been tracked in KEV, the simplicity of the attack and potential for intelligence gathering in preparation for more sophisticated attacks justify urgent remediation. Organizations with sensitive operations or regulated data should prioritize this immediately.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-adjacent attack vector, low attack complexity, no privilege requirements, no user interaction needed, and high confidentiality impact. The vulnerability does not directly compromise integrity or availability, which keeps the score below critical. However, the high confidentiality impact and ease of exploitation justify the HIGH severity rating and urgent attention from security teams.

Frequently asked questions