Technical impact
The vulnerability lies in the debugging routine SCREEN_CLICK(5053), which allows a remote or local attacker to bypass the standard device login prompt and directly spawn an interactive shell on the router. This flaw results in a full authentication bypass and grants the attacker the same privileges as a legitimate user, effectively providing remote code execution on the device.
Affected Systems
Acer Connect M6E 5G Portable WiFi Router is affected. No specific firmware version information is provided in the current data.
Risk and Exploitability
The CVSS score of 9.4 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of EPSS does not diminish the potential risk. The likely attack vector is through the provision of the debugging instruction over a communication channel that the device accepts, which an attacker could trigger from a nearby or remote network if the debug interface is exposed. If exploited, the attacker gains unrestricted access to device configuration and network traffic, posing severe confidentiality, integrity, and availability risks.
