The summary service endpoint for the Acer Connect M6E 5G Portable WiFi Router contains an insecure direct object reference that does not verify that a user owns a requested hardware serial number. This flaw allows an attacker to request information for any serial number and retrieve device data that should be restricted. The vulnerability results in the exposure of confidential device details such as configuration or usage metrics.

Acer Connect M6E 5G Portable WiFi Router

The vulnerability has a CVSS score of 5.3, indicating medium severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated or local network user who can send requests to the summary service for arbitrary serial numbers, or an attacker who can intercept these requests over the network. Because the flaw is an IDOR, exploitation only requires the ability to access the service endpoint, and it can be performed without additional privileges beyond network access to the device.