CVE-2026-50226

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - 8fc372e3-d9c5-46e4-9410-38469745c639

Published

2026-06-04

Last modified

2026-06-04

Weaknesses

CWE-321

Affected products

• Connect M6e 5g Firmware (Acer)
• Connect M6e 5g Portable Wifi Router (Acer)

References

• https://community.acer.com/en/kb/articles/19707