Unchecked public access permissions on a core Broadcast Receiver allow local software components to trigger administrative operations without proper authorization. This flaw can be leveraged to gain elevated privileges on the device, enabling an attacker to perform functions normally available only to the device’s administrative tenant. The primary consequence is local privilege escalation, potentially leading to total device compromise.

Acer Connect M6E 5G Portable WiFi Router is the affected product. No specific firmware versions are listed in the advisory, so all current releases should be considered susceptible until a patch is released.

The CVSS score of 8.5 indicates a high severity for local privilege escalation. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. The attack vector is inferred to be local; an attacker must execute code or otherwise invoke the broadcast on the target device. Once triggered, the malicious component can perform privileged administrative actions, potentially disabling the router, reconfiguring it, or accessing sensitive network traffic.