The vulnerability is a permissive TrustAllCerts routine that disables standard TLS certificate validation. Because the router also stores DES keys in the firmware, an attacker performing a man‑in‑the‑middle could intercept encrypted traffic and decrypt it with the known keys, leaking sensitive data.

Affected product: Acer Connect M6E 5G Portable WiFi Router. No specific version information is provided in the advisory; all firmware revisions for this model may be impacted until a fix is applied.

CVSS score of 9.2 indicates a high severity issue. While no EPSS score is available, the lack of mitigation implies a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers with network access could operate a MITM to intercept traffic; the absence of certificate checks and the presence of weak DES keys provide a straightforward path to decrypt data and potentially read or alter contextual information.