Technical impact
Broadcast events on the device allow a malicious application to overwrite the default Mobile Device Management endpoint address, effectively changing who controls the device. This flaw enables an attacker to gain full administrative rights, including policy enforcement, firmware updates, and data access, resulting in loss of device integrity and confidentiality. The weakness corresponds to missing or ineffective authorization controls (CWE‑732).
Affected Systems
Acer Connect M6E 5G Portable WiFi Router. No version details were supplied; the vulnerability applies to all affected units of this model with the current firmware stack.
Risk and Exploitability
The CVSS score of 9.3 indicates critical severity, and the vulnerability is listed as not yet in the CISA KEV catalog. The exploitation likelihood is high for an attacker who can generate or modify broadcast events targeting the device, as no specific mitigation is required to trigger the flaw. Absence of an EPSS value precludes an exact estimate but the combination of remote denial of proper MDM control and the straightforward manipulation mechanism makes the risk significant.
