CVE-2026-49191 is a critical (CVSS 9.8) authentication weakness in the Acer Connect M6E 5G router firmware. The production build of M3WebServer hard-codes its backend API keys, and verbose error pages can reveal them. The record names no fixed version, so check Acer's advisory and update the firmware.
What's affected
- Product: Acer Connect M6E 5G, hardware and firmware.
- Fixed version: not stated in the CVE record. Check Acer's advisory (article 19707).
- Weakness: CWE-287, improper authentication.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Published 4 June 2026. Not on the CISA Known Exploited Vulnerabilities list at the time of review.
The same advisory page covers several other CVEs for this device, including CVE-2026-50208, CVE-2026-50211, CVE-2026-50214 and CVE-2026-50225.
How to check if you're exposed
Acer ships these devices as consumer networking hardware, so there is no package manager to query. Use the device itself.
- Log in to the Acer Connect M6E 5G admin page or the Acer Connect app and note the firmware version shown in the device or system information screen.
- Open the Acer advisory named in the Sources section and compare your version with the fixed firmware it lists.
- If the admin page or any service on the device is reachable from the internet, treat that as a separate problem and close it, whatever the firmware version.
What to do now
- Open the Acer advisory (knowledge base article 19707) and confirm which Acer Connect M6E 5G firmware fixes this CVE. The CVE record does not name a fixed version, so do not assume one.
- Install the fixed firmware through the vendor update path as soon as it is available for your unit.
- Until then, keep the admin interface off the internet and limit it to a trusted management network.
- Change any password or key that was stored on or sent through the device if you think it may have been exposed.
- Add the device to your asset inventory with its firmware version so the next advisory is easy to match.
Why it matters
A key compiled into a production build is the same key on every unit. Anyone who learns it once learns it for the whole product line, and a verbose error page is one easy way to learn it. The record describes exactly that pairing.
This is a classic CWE-287 problem: the backend trusts a shared secret instead of checking who is calling. Secrets belong in per-device or per-account storage, and error pages in production should say little. If you build firmware or web services, scan your own repositories for committed keys before they ship.
Quick check
Is CVE-2026-49191 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and I found no advisory text saying it is exploited. That can change, so check the vendor page.
Sources
- Acer knowledge base article 19707 (named in the CVE record; the page was behind a browser check when I tried to read it, so the details here come from the CVE record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
