CVE-2026-50205: Acer Connect M6E 5G SMTP Password Exposure in System Logs

Technical summary

CVE-2026-50205 involves improper logging practices in Acer Connect M6E 5G firmware where SMTP server authentication credentials are written to system log files without encryption or obfuscation. The vulnerability additionally logs sensitive employee corporate identification data in the same unprotected files. This maps to CWE-532 (Insertion of Sensitive Information into Log File), reflecting a failure to implement proper log sanitization and encryption controls. The CVSS 3.1 score of 8.2 (HIGH) reflects a network-accessible vulnerability requiring no authentication or user interaction, with high confidentiality impact and low integrity impact—attackers can exfiltrate credentials and corporate data, and potentially modify logs to cover tracks.

Business impact

Organizations deploying Acer Connect M6E 5G devices face credential compromise affecting email account security. Exposed SMTP passwords enable unauthorized email access, impersonation, and potential lateral movement into corporate messaging infrastructure. Concurrent exposure of employee corporate identifiers creates privacy violations and compliance risks under data protection regulations. Affected organizations should assume email systems reachable by the compromised router are at elevated risk and plan incident response around email account audits and credential rotation.

Affected systems

The vulnerability affects Acer Connect M6E 5G routers (both the firmware and device variants). Any deployment of this model with SMTP logging enabled is vulnerable. Organizations should audit their device inventory to identify M6E 5G units in production, particularly those used as primary or secondary network access points where SMTP traffic traversal is likely.

Exploitability

Exploitation requires logical or physical access to the affected device to read system log files. No network exploit or remote code execution is necessary—an attacker with shell access, unauthorized device login, or physical device access can trivially extract plaintext credentials and corporate data from logs. The barrier to exploitation is low once an attacker gains local device access; it is not a network-remote vulnerability in the traditional sense, but the prevalence of weak default credentials and exposed management interfaces on many routers makes such access realistic in practice.

Remediation

Acer should issue firmware updates for the Connect M6E 5G line that implement the following: (1) cease logging SMTP authentication credentials, or if logging is operationally necessary, encrypt log entries containing credentials; (2) sanitize corporate identification data from logs; (3) restrict log file permissions to root or administrator accounts only; (4) implement log rotation and retention policies. Organizations should verify patch availability from Acer and apply updates to all affected devices in their environment. Until patches are available, administrative controls such as restricting device access and disabling unnecessary logging features should be considered.

Patch guidance

Check the Acer support portal for firmware updates to the Connect M6E 5G. Verify that any published update explicitly addresses log credential exposure. Organizations should establish a change window to test patches in a lab environment before production deployment, as firmware updates to network appliances carry inherent risk. Ensure backups are available before firmware updates. Once patched, clear existing log files that may contain exposed credentials. Verify patch application through device web interface or CLI.

Detection guidance

Organizations can detect the vulnerability by accessing Acer Connect M6E 5G device logs (typically via web admin interface or SSH) and searching for SMTP authentication data or employee identification strings in plaintext. Tools like grep or log analysis utilities can search for patterns matching password fields or corporate ID formats. Monitor recent access logs to the M6E 5G management interface for unauthorized login attempts. Network-side monitoring for unusual SMTP traffic patterns originating from or traversing through M6E 5G devices may indicate exploitation.

Why prioritize this

This vulnerability merits high priority due to direct credential exposure (CVSS 8.2, HIGH severity), the sensitivity of email account compromise, and the ease of exploitation once device access is gained. Email systems are foundational to corporate communication and often hold high-value targets for lateral movement. The concurrent exposure of employee identification data compounds privacy and regulatory risk. However, because network-remote exploitation is not possible, organizations with strong device access controls and network segmentation may deprioritize slightly below critical issues—but should still remediate promptly.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: (1) Network Attack Vector (AV:N)—logs are accessible over management interfaces; (2) Low Attack Complexity (AC:L)—no special conditions required to access logs; (3) No authentication required (PR:N, UI:N); (4) High confidentiality impact (C:H)—passwords and corporate data are fully exposed; (5) Low integrity impact (I:L)—logs may be modified; (6) No availability impact (A:N). The score does not assume attacker must first gain local device access; rather, it assumes the device's management interface may be reachable remotely, making log access feasible. Organizations with network segmentation isolating M6E 5G management interfaces may assess local risk lower in practice.

Frequently asked questions