Technical impact
A security weakness in the configuration of cloud storage containers lets anyone on the internet read telemetry data that should have remained confidential. The flaw is an information exposure vulnerability (CWE-200) that allows disclosure of potentially sensitive device operation metrics. No code execution or direct system compromise is possible, but exposed data could aid adversaries in reconnaissance or planning subsequent attacks.
Affected Systems
The vulnerability affects the Acer Connect M6E 5G Portable WiFi Router. Users who rely on the default or legacy firmware that does not restrict access to the cloud storage containers are at risk. The vendor may offer firmware updates that tighten or correct bucket policies.
Risk and Exploitability
The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of those metrics does not reduce risk. Based on the title, it is inferred that the cloud storage is AWS S3 buckets, which can be accessed via standard HTTP requests if public read permission is enabled. Attackers require no special privileges and can retrieve the telemetry data simply by targeting the public endpoint. The vulnerability can be exploited whenever any Internet user can reach the container.
