CVE-2026-50208 is a critical (CVSS 9.4) flaw in Acer Connect M6E 5G firmware. Routines that trust every TLS certificate, combined with hard-coded DES keys, let a person in the network path decrypt traffic. The record gives no fixed version, so check Acer's advisory and update.
What's affected
- Product: Acer Connect M6E 5G, hardware and firmware.
- Fixed version: not stated in the CVE record. Check Acer's advisory (article 19707).
- Weakness: CWE-330, use of insufficiently random values (the record's classification).
- CVSS 9.4 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. - Published 4 June 2026. Not marked as exploited in CISA KEV.
How to check if you're exposed
Acer ships these devices as consumer networking hardware, so there is no package manager to query. Use the device itself.
- Log in to the Acer Connect M6E 5G admin page or the Acer Connect app and note the firmware version shown in the device or system information screen.
- Open the Acer advisory named in the Sources section and compare your version with the fixed firmware it lists.
- If the admin page or any service on the device is reachable from the internet, treat that as a separate problem and close it, whatever the firmware version.
Because the issue is about traffic interception, also ask whether the device ever talks to the internet over untrusted Wi-Fi or shared links. Those are the paths an interceptor would use.
What to do now
- Open the Acer advisory (knowledge base article 19707) and confirm which Acer Connect M6E 5G firmware fixes this CVE. The CVE record does not name a fixed version, so do not assume one.
- Install the fixed firmware through the vendor update path as soon as it is available for your unit.
- Until then, keep the admin interface off the internet and limit it to a trusted management network.
- Change any password or key that was stored on or sent through the device if you think it may have been exposed.
- Add the device to your asset inventory with its firmware version so the next advisory is easy to match.
Why it matters
TLS only protects you when the client checks the certificate. A routine that accepts every certificate turns encryption into decoration, because anyone sitting between the device and its server can present their own. Hard-coded symmetric keys add a second problem: the same key works everywhere, so a single extraction breaks the whole product line.
The CVE record files this under CWE-330. The practical lesson is simple. Validate certificates, never ship a trust-all hook in production, and keep keys out of binaries.
Quick check
Does this mean my traffic is already being read?
No. The record describes what an interceptor in the network path could do, not that anyone is doing it. Update the firmware and avoid untrusted networks until you have.
Sources
- Acer knowledge base article 19707 (named in the CVE record; the page was behind a browser check when I tried to read it, so the details here come from the CVE record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
