The vulnerability in the /v1/Plan service stems from its reliance on a shared global API token that grants full administrative control, enabling an attacker who obtains this token to create unlimited zero‑cost network access plans. This leads to unauthorized configuration changes that can affect service integrity and potentially disrupt network operation. The flaw is a broken resource usage control (CWE‑345).

The issue affects Acer Connect M6E 5G Portable WiFi Router firmware that includes the vulnerable service. Because no specific affected versions are listed, any firmware version containing the /v1/Plan endpoint that uses a shared API token may be compromised. Administrators should verify which firmware versions are in use and seek an update that removes the shared token requirement.

The CVSS score of 9.3 indicates critical severity, and while the EPSS score is not available, the lack of a publicly known exploit does not reduce the risk if an attacker can gain the API token. The vulnerability can be exploited remotely through the exposed API, and could also be leveraged locally if physical access or social engineering occurs. No KEV listing currently exists, but the potential for large‑scale quota inflation warrants immediate attention. Applying a vendor‑issued fix or mitigating controls is essential.