CVE-2026-50205

Plaintext Log Credential Leakage

Published Jun 4, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.

Analysis

Technical impact

The vulnerability causes the device to record SMTP authentication passwords and employee corporate identification data in plain text within system logs. This exposes confidential credentials and personal data, allowing an attacker who obtains the logs to steal login credentials and potentially gain unauthorized access to corporate resources. The weakness corresponds to CWE-532, Log File Manipulation.

Affected Systems

Acer Connect M6E 5G Portable WiFi Router. No specific firmware version information is provided.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. EPSS score is not available, and the issue is not listed in CISA KEV. The likely attack vector is local or remote access to device logs, but the exact vector is not specified; thus the risk depends on how the logs are stored and accessed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Acer

Connect M6E 5G Portable WiFi Router

unaffected

Version	Status	Constraints
`*`	affected	≤ M6E_AI_1.00.000019

Configuration 1 [-]

AND

cpe:2.3:o:acer:connect_m6e_5g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:acer:connect_m6e_5g:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Acer

Connect M6e 5g Portable Wifi Router

Version	Status	Scheme	Platform
`[0,M6E_AI_1.00.000019]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware release from Acer that removes credential logging or corrects the log format.
Disable or restrict logging of SMTP authentication credentials in the device configuration.
Ensure that log files are stored with strict file permission controls and transmit them only over secure channels if necessary.
Change all compromised SMTP credentials and update device passwords.

Generated by OpenCVE AI on June 4, 2026 at 08:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.238% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://community.acer.com/en/kb/articles/19707

History

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Acer connect M6e 5g Portable Wifi Router
Vendors & Products		Acer connect M6e 5g Portable Wifi Router

Jun 4, 2026 7:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Acer Acer connect M6e 5g Acer connect M6e 5g Firmware
CPEs		cpe:2.3:h:acer:connect_m6e_5g:-:::::::* cpe:2.3:o:acer:connect_m6e_5g_firmware::::::::
Vendors & Products		Acer Acer connect M6e 5g Acer connect M6e 5g Firmware
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}`

Jun 4, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2026 7:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
Title		Plaintext Log Credential Leakage
Weaknesses		CWE-532
References		https://community.acer.com/en/kb/articles/19707
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}`