The vulnerability is that the production build of the M3WebServer hard‑codes its backend API keys, and these keys can be captured through verbose error handling pages. An attacker who can trigger such error pages can retrieve the hard‑coded key and use the backend APIs with full privilege, enabling configuration changes, service disruption, or exploitation of other devices on the same network. The weakness is an authentication flaw (CWE‑287), leading to significant loss of confidentiality, integrity, and potentially availability of the router’s management interface.

Acer Connect M6E 5G Portable WiFi Router. No version details are specified, but the vulnerability exists in the production firmware of this router model.

The CVSS score of 9.3 marks this issue as critical. Although an EPSS score is not provided, the combination of a hard‑coded key, easy interception, and network‑exposed error pages indicates a high likelihood of exploitation on connected networks. The vulnerability is not listed in CISA’s KEV catalog, but its severity and exploitability still warrant immediate attention. Likely the attack vector is over the local network, where any device who can reach the router’s management interface may trigger the verbose error pages and capture the key.