Technical impact
The vulnerability involves hard‑coded APK resource files that never expire and a shared scepter, allowing information leaks and potential misuse of the credentials stored in the router. This flaw directly exposes sensitive data and credentials, enabling attackers to obtain information that should be protected, in line with CWE‑200. No further exploitation mechanisms are described in the CVE entry.
Affected Systems
The affected product is the Acer Connect M6E 5G Portable WiFi Router. No specific firmware version is listed, so all current and prior releases may be impacted until a patch is issued.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS value is not available, and the issue is not in the CISA KEV catalog, suggesting no publicly known exploits at this time. Based on the description, the likely attack vector is local network access to the router, where an attacker can download or read the hard‑coded APK files to extract credentials. Since there is no official patch listed, the risk remains until the vendor releases a firmware update that removes the hard‑coded resources.
