CVE-2026-50212

Arbitrary Remote Device Unbinding

Published Jun 4, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.

Analysis

Technical impact

The vulnerability stems from improper validation in the device dissociation API on Acer Connect M6E 5G Portable WiFi Routers. An unauthenticated or authorized remote actor can send crafted commands that force the router to unbind user endpoints that are unrelated to the actor, causing a severe denial of service for those endpoints and disrupting connectivity for affected users.

Affected Systems

Affected hardware includes Acer Connect M6E 5G Portable WiFi Routers. No specific firmware revisions were disclosed, so all current releases should be considered potentially vulnerable until an update is issued.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, signifying a high impact. No EPSS data is available and the issue is not yet listed in the CISA KEV catalog. Attackers can exploit it remotely by targeting the dissociation API endpoint over the management interface. Mitigation is currently limited to vendor firmware updates, so monitoring and restricting access are the primary preventive measures.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Acer

Connect M6E 5G Portable WiFi Router

unaffected

Version	Status	Constraints
`*`	affected	≤ M6E_AI_1.00.000019

Configuration 1 [-]

AND

cpe:2.3:o:acer:connect_m6e_5g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:acer:connect_m6e_5g:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Acer

Connect M6e 5g Portable Wifi Router

Version	Status	Scheme	Platform
`[0,M6E_AI_1.00.000019]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update released by Acer.
Restrict or disable remote access to the device dissociation API, for example by firewall rules or disabling remote management.
Monitor router logs and network traffic for unauthorized unbinding attempts and investigate any suspicious activity.

Generated by OpenCVE AI on June 4, 2026 at 09:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://community.acer.com/en/kb/articles/19707

History

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Acer connect M6e 5g Portable Wifi Router
Vendors & Products		Acer connect M6e 5g Portable Wifi Router

Jun 4, 2026 7:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Acer Acer connect M6e 5g Acer connect M6e 5g Firmware
CPEs		cpe:2.3:h:acer:connect_m6e_5g:-:::::::* cpe:2.3:o:acer:connect_m6e_5g_firmware::::::::
Vendors & Products		Acer Acer connect M6e 5g Acer connect M6e 5g Firmware
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Jun 4, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.
Title		Arbitrary Remote Device Unbinding
Weaknesses		CWE-400
References		https://community.acer.com/en/kb/articles/19707
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`