The vulnerability arises from a failure to enforce instruction‑level authorization checks, allowing an attacker to inject privileged operation codes. The flaw permits the installation of unauthorized applications or arbitrary command execution, compromising the router's integrity and potentially enabling remote control of the device. This constitutes a high‑severity flaw that violates the principle of least privilege.

Vulnerable hardware consists of Acer's Connect M6E 5G Portable WiFi Router. No specific firmware version information was provided in the advisory.

The CVSS score of 9.4 indicates a critical impact, and the lack of an EPSS score means we cannot estimate current exploitation probability. The vulnerability is not listed in CISA's KEV catalog. An attacker could potentially trigger the bug through network traffic or a remote management interface, as no restriction on opcode execution is enforced. The absence of built-in authorization checks gives the attacker the ability to bypass normal security controls, making the attack path relatively straightforward if the device is reachable.