Technical impact
The vulnerability exists in the system Binder boundary, which accepts AT commands without proper verification. This flaw allows a local application to issue arbitrary AT commands that can read baseband files or disable cellular connectivity. The impact is local access to sensitive modem data and denial of cellular service, giving an attacker potential data exposure or service disruption.
Affected Systems
Acer Connect M6E 5G Portable WiFi Router. No specific firmware or software version information is provided in the current data, so all installed units running this product are considered potentially vulnerable.
Risk and Exploitability
The CVSS score of 8.5 classifies the issue as High severity. Since no EPSS score is available, the exploitation probability distribution cannot be quantified, but the lack of listing in the CISA KEV catalog suggests no evidence of active exploitation at this time. The attack vector is local, requiring the attacker to run a malicious application on the device or to have local code execution capability. If such local access is achieved, the flaw can be abused to read baseband files or break cellular connectivity, potentially impacting data confidentiality and availability.
