The vulnerability stems from improper validation in the device dissociation API on Acer Connect M6E 5G Portable WiFi Routers. An unauthenticated or authorized remote actor can send crafted commands that force the router to unbind user endpoints that are unrelated to the actor, causing a severe denial of service for those endpoints and disrupting connectivity for affected users.

Affected hardware includes Acer Connect M6E 5G Portable WiFi Routers. No specific firmware revisions were disclosed, so all current releases should be considered potentially vulnerable until an update is issued.

The vulnerability carries a CVSS score of 7.1, signifying a high impact. No EPSS data is available and the issue is not yet listed in the CISA KEV catalog. Attackers can exploit it remotely by targeting the dissociation API endpoint over the management interface. Mitigation is currently limited to vendor firmware updates, so monitoring and restricting access are the primary preventive measures.