CVE-2026-50225 is a critical (CVSS 9.1) flaw in the Acer Connect M6E 5G ecosystem. The /v1/account/register path has no bot mitigation, so automated systems can flood the database. The record names no fixed version, so check Acer's advisory (article 19707) for the remediation.
What's affected
- Product: Acer Connect M6E 5G, hardware and firmware.
- Fixed version: not stated in the CVE record. Check Acer's advisory (article 19707).
- Weakness: CWE-306, missing authentication for a critical function.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. - Published 4 June 2026. Not marked as exploited in CISA KEV.
How to check if you're exposed
Acer ships these devices as consumer networking hardware, so there is no package manager to query. Use the device itself.
- Log in to the Acer Connect M6E 5G admin page or the Acer Connect app and note the firmware version shown in the device or system information screen.
- Open the Acer advisory named in the Sources section and compare your version with the fixed firmware it lists.
- If the admin page or any service on the device is reachable from the internet, treat that as a separate problem and close it, whatever the firmware version.
What to do now
- Open the Acer advisory (knowledge base article 19707) and confirm which Acer Connect M6E 5G firmware fixes this CVE. The CVE record does not name a fixed version, so do not assume one.
- Install the fixed firmware through the vendor update path as soon as it is available for your unit.
- Until then, keep the admin interface off the internet and limit it to a trusted management network.
- Change any password or key that was stored on or sent through the device if you think it may have been exposed.
Why it matters
Open registration is fine when something limits it. Without rate limits, proof of work, email checks or a challenge, a script can create accounts faster than any service can store or clean them up. The record's impact scores are integrity and availability, which matches database flooding.
If you run any public sign-up form, test it the way a bot would use it, and add throttling at the edge and at the application. The record files the issue under CWE-306.
Quick check
Is this a data leak?
No. The record scores confidentiality as none. The risk is integrity and availability of the service.
Sources
- Acer knowledge base article 19707 (named in the CVE record; the page was behind a browser check when I tried to read it, so the details here come from the CVE record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
