CVE-2026-50207: Acer Connect M6E 5G Baseband AT Command Injection – CVSS 7.8 HIGH

Technical summary

CVE-2026-50207 is a boundary validation weakness in the Binder IPC mechanism on the Acer Connect M6E 5G that fails to verify AT commands before passing them through to the baseband processor. AT commands—the legacy protocol for controlling cellular modems—can be misused to read protected firmware, configuration files, or IMSI data, or to disable cellular radio functionality. The vulnerability maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), indicating inadequate access control on a critical interface. With a CVSS 3.1 score of 7.8 (HIGH), it carries high impact to confidentiality, integrity, and availability, though exploitation requires local application-level privileges.

Business impact

Organizations deploying Acer Connect M6E 5G devices in enterprise or shared-use environments face risk of unauthorized data exfiltration, service disruption, and potential compliance violations if baseband data or customer information is accessed. Cellular connectivity is often critical for backup or primary communication; disabling it could interrupt business operations. The local privilege requirement limits exposure but does not eliminate it in BYOD or managed app ecosystems where multiple applications coexist. This vulnerability underscores the need for strict app vetting and network segmentation for mobile connectivity appliances.

Affected systems

The vulnerability impacts Acer Connect M6E 5G devices and associated firmware. This appears to be a mobile hotspot or 5G connectivity appliance. Verify the exact affected firmware versions against Acer's official advisory. Devices already deployed in production should be inventoried and assessed for whether local application execution can be controlled via app policies or network policies.

Exploitability

Exploitation is practical for an attacker with local application execution on the device. The local requirement (AV:L) and need for low privileges (PR:L) mean this is accessible to unprivileged apps or sideloaded code, but not to remote network attackers. No authentication bypass or complex interactions are required once execution is achieved (AC:L). The attack surface widens in settings where users can install arbitrary applications or where the device runs third-party firmware.

Remediation

Apply the latest firmware patch released by Acer for the Connect M6E 5G. The patch should add input validation and authorization checks to the Binder interface handling AT commands, ensuring only privileged system processes can invoke baseband operations. Until patching is complete, restrict local application execution on affected devices through platform security policies and app allowlisting where feasible. Monitor for suspicious AT command activity if forensic logging is available.

Patch guidance

Check Acer's support portal for the Connect M6E 5G for the latest firmware release dated after June 17, 2026 (the vulnerability modification date). Firmware updates typically require a wired connection or a specific update mode; review Acer's release notes for instructions. Test patches in a non-production environment first. If automatic updates are available, enable them. Verify the patch version number and checksum against Acer's official advisory before deployment.

Detection guidance

Monitor for local Binder calls that invoke AT command handlers with unchecked arguments, particularly commands that read memory or disable radio functionality (e.g., AT+QFASTBOOT, AT+CFUN=0). If your device offers baseband or system logs, look for unauthorized AT command sequences. Network-level detection is limited since the vulnerability is local, but monitor for unexpected cellular service state changes. Consider deploying Mobile Threat Defense (MTD) tools that can audit baseband-level operations if supported on this platform.

Why prioritize this

The vulnerability merits prompt patching due to its HIGH CVSS score and the sensitivity of baseband data. Baseband firmware, IMSI information, and cellular connectivity are fundamental to device function and user privacy. While the local privilege requirement limits attack surface compared to remote vulnerabilities, untrusted applications pose a credible threat in shared-device scenarios. The lack of KEV (Known Exploited Vulnerabilities) status does not reduce the risk; prioritize based on your inventory of these devices and your app governance posture.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects high impact across confidentiality (reading baseband files), integrity (modifying cellular settings), and availability (disabling service), offset partially by the requirement for local access and low privileges. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates this is a serious but not critical-level flaw. It does not propagate to other users or systems, but affects the targeted device completely.

Frequently asked questions