Unchecked public access permissions on a core Broadcast Receiver

CVE-2026-49189 affects Acer Connect M6E 5G portable Wi-Fi routers running firmware M6E_AI_1.00.000019 or earlier. Acer describes it as unchecked public access on a core Android-style Broadcast Receiver, which means a local software component on the device can send a broadcast and trigger administrative actions that should have been restricted.

There is no published vendor CVSS baseline here, so this is a first-principles call. In practice this is not an internet-reachable one-shot bug; it is a *post-compromise/local-position* privilege escalation on a relatively narrow device population. That sharply limits urgency, but the impact is still real because administrative operations on a mobile router can alter network behavior, device ownership, and trust settings if an attacker already has code execution on the unit.

Why this verdict

• Major downward pressure: requires local execution on the device. This is not unauthenticated remote and not even ordinary authenticated remote; it assumes the attacker can already run a software component on the hotspot.
• Compounding friction: post-compromise on a narrow platform. A dedicated portable router is a much smaller and less app-friendly target population than Windows, browsers, VPNs, or enterprise web middleware.
• Upward pressure: admin operations on a network device matter. If the receiver can change privileged state, the attacker may tamper with connectivity, trust settings, or management behavior in ways that outlast the initial foothold.

Why not higher?

It is not higher because the attack chain starts from a constrained prerequisite that many real deployments never expose: code execution on the appliance itself. There is no reviewed evidence of KEV listing, active campaigns, or a direct internet-triggerable path for this specific CVE, so scoring it like a remote edge-device takeover would be wrong.

Why not lower?

It is not lower because this is still a privilege boundary failure on a routing device, not cosmetic hardening debt. Once an attacker gets local execution, a publicly callable administrative receiver can become a reliable pivot for persistence, policy tampering, or chaining into higher-value network abuse.

1. Eliminate local maintenance exposure — Disable or tightly gate any debug, servicing, or software-loading path that can place code on the M6E. Because this is a MEDIUM finding there is no mitigation SLA, so do this as normal hardening rather than an emergency change, then complete vendor remediation within the 365-day window once Acer ships the fix.
2. Restrict where these hotspots are trusted — Treat M6E units as semi-trusted edge devices: keep them off privileged management segments, avoid using them as implicit trust anchors, and limit what downstream systems they can administer. This reduces blast radius if a local receiver-abuse chain lands on a device.
3. Inventory affected firmware now — Build a list of every M6E at M6E_AI_1.00.000019 or earlier, tag business owners, and pre-stage the firmware rollout process. There is no mitigation SLA at MEDIUM, but inventory work should happen during the next normal operations cycle so the eventual patch is not delayed by asset uncertainty.
4. Monitor for unexplained admin-state changes — Review device settings, management endpoints, VPN profiles, and network behavior for drift that cannot be tied to approved change records. This will not prevent exploitation, but it can surface a compromised unit before the device is reused in a more sensitive environment.

Run this on an auditor workstation, jump host, or CI job with Python 3; no elevated privileges are required. Invoke it with the firmware version you read from the device screen or Admin Web UI, for example python3 verify_cve_2026_49189.py --version M6E_AI_1.00.000019; if Acer later publishes an exact fixed build, add --fixed-version <build> to allow a definitive PATCHED result.

#!/usr/bin/env python3
# verify_cve_2026_49189.py
# Check Acer Connect M6E firmware exposure for CVE-2026-49189.
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage error
#
# Usage examples:
#   python3 verify_cve_2026_49189.py --version M6E_AI_1.00.000019
#   python3 verify_cve_2026_49189.py --version M6E_AI_1.00.000020 --fixed-version M6E_AI_1.00.000020

import argparse
import re
import sys

AFFECTED_MAX = "M6E_AI_1.00.000019"


def normalize(v: str):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def main():
    parser = argparse.ArgumentParser(description='Assess Acer Connect M6E exposure to CVE-2026-49189 by firmware version.')
    parser.add_argument('--version', required=True, help='Observed device firmware version, e.g. M6E_AI_1.00.000019')
    parser.add_argument('--fixed-version', required=False, help='Vendor-published fixed firmware version, if/when Acer discloses it')
    args = parser.parse_args()

    current = normalize(args.version)
    affected = normalize(AFFECTED_MAX)

    if current is None:
        print('UNKNOWN - could not parse --version value')
        sys.exit(2)

    if current <= affected:
        print(f'VULNERABLE - observed version {args.version} is <= affected maximum {AFFECTED_MAX}')
        sys.exit(1)

    if args.fixed_version:
        fixed = normalize(args.fixed_version)
        if fixed is None:
            print('UNKNOWN - could not parse --fixed-version value')
            sys.exit(2)
        if current >= fixed:
            print(f'PATCHED - observed version {args.version} is >= fixed version {args.fixed_version}')
            sys.exit(0)
        print(f'UNKNOWN - observed version {args.version} is above known affected range but below declared fixed version {args.fixed_version}')
        sys.exit(2)

    print(f'UNKNOWN - observed version {args.version} is above {AFFECTED_MAX}, but Acer has not published a confirmed fixed version in the reviewed advisory')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Acer security advisory for Acer Connect M6E vulnerabilities
2. Acer Connect M6E product page
3. Acer Connect M6E user manual PDF
4. FIRST EPSS API documentation
5. FIRST EPSS data and report documentation
6. CISA Known Exploited Vulnerabilities Catalog