Technical impact
The vulnerability allows callers to interact with critical cellular eSIM allocation endpoints without any authentication. As a result, an attacker could remotely rewrite or delete existing eSIM profiles, which can compromise the device’s connectivity and integrity of subscriber information. Because the flaw is an authentication bypass, it is classed as CWE-287.
Affected Systems
Acer’s Connect M6E 5G Portable WiFi Router is affected. No specific firmware or model version information is disclosed in the data provided.
Risk and Exploitability
The CVSS score of 7.2 indicates a high-risk condition. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker sending unauthenticated requests to the router’s management API over the network. If the API is exposed to external networks, the flaw can be exploited with minimal effort, enabling unauthorized eSIM configuration changes and potential denial of service for cellular connectivity.
