CVE-2026-50212: Acer Connect M6E 5G Denial-of-Service API Vulnerability

Technical summary

The vulnerability resides in device dissociation API routines within Acer Connect M6E 5G firmware. The underlying issue is classified as CWE-400 (Uncontrolled Resource Consumption), indicating improper validation logic that fails to verify the requester's authorization before processing device unbinding requests. The attack vector is adjacent network (AV:A), meaning the attacker must be on the same network segment; however, once positioned, no privilege or user interaction is needed. The result is uncontrolled disruption of device availability for other users.

Business impact

Service disruption affecting users of Acer Connect M6E 5G mobile hotspot devices. An attacker can selectively disconnect competing or targeted users, preventing them from accessing connectivity. In enterprise or shared-access scenarios, this creates a denial-of-service condition that degrades user experience and productivity. The impact is heightened in environments where hotspot connectivity is critical to operations, such as field teams, temporary offices, or backup internet provisioning.

Affected systems

Acer Connect M6E 5G firmware and the Acer Connect M6E 5G device. Organizations and individuals relying on this 5G mobile hotspot should assess whether they have deployed units in network environments where untrusted parties or less-controlled segments are present.

Exploitability

Exploitation requires presence on the same network segment as the target device (adjacent network access). No authentication, privileges, or user interaction are necessary. An attacker can programmatically invoke the dissociation API with crafted requests targeting arbitrary endpoints. The low attack complexity and absence of access controls make this practical to exploit once an attacker gains network proximity. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Apply the firmware patch issued by Acer for the Connect M6E 5G. The patch should restore proper authorization validation to the device dissociation API, ensuring that only authorized requests can unbind endpoints. Until patching is feasible, isolate affected devices on trusted network segments and restrict access to the device management interface from untrusted or semi-trusted networks.

Patch guidance

Check Acer's official security advisory and firmware download portal for the latest Connect M6E 5G firmware release addressing CVE-2026-50212. Verify the firmware version before and after deployment. If automatic firmware updates are available through the device settings, enable them. For enterprise deployments, test patched firmware in a lab environment before rolling out to production. Document the patch version applied for compliance and audit records.

Detection guidance

Monitor network traffic for unusual dissociation API calls to the device management interface. Log any successful device unbinding events and correlate them with user-initiated requests—unauthorized dissociations should trigger alerts. Implement network segmentation to limit which devices can reach the management API. Check device logs for failed authentication attempts against the dissociation endpoint. Intrusion detection signatures targeting malformed or suspicious dissociation payloads may help identify attack attempts in real time.

Why prioritize this

Although assigned a MEDIUM CVSS score (6.5), this vulnerability merits prompt attention because it enables straightforward network-adjacent denial of service with no prerequisites. Organizations operating Acer Connect M6E 5G hotspots in environments where network access cannot be fully controlled—such as co-working spaces, public venues, or field operations—face practical exploitation risk. The availability impact is direct and user-facing, making it operationally disruptive even if confidentiality and integrity are not compromised.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects attack vector AV:A (adjacent network), low attack complexity, no privilege requirement, and high availability impact. The score appropriately captures a network-local threat with significant disruption potential. However, business risk may be higher in scenarios where hotspot availability is mission-critical or where network perimeter controls are weak, warranting consideration of organizational context when prioritizing remediation.

Frequently asked questions