Technical impact
The /v1/account/register registration path in Acer:Connect M6E 5G Portable WiFi Router has no bot mitigation, enabling automated systems to flood the database. This results in resource exhaustion and degraded or unavailable service, effectively denying legitimate account creation and potentially disrupting overall router operation.
Affected Systems
Acer:Connect M6E 5G Portable WiFi Router is affected. No specific firmware versions are listed, so all current releases may be at risk until a patch or mitigation is deployed.
Risk and Exploitability
With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in CISA KEV, but the lack of authentication and rate limiting on the public registration endpoint makes it a straightforward target for automated attacks. An attacker only needs network access to the router and can repeatedly invoke the endpoint to exhaust bandwidth and storage, leading to a denial of service.
