PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50208 Acer CVE debrief

Acer Connect M6E 5G firmware contains critical TLS security weaknesses. TrustAllCerts routines disable standard certificate validation, and hard-coded DES symmetric encryption keys are present. A network-positioned attacker could exploit these flaws in a Man-in-the-Middle (MITM) scenario to decrypt network traffic. The vulnerability affects Connect M6E 5G firmware versions up to and including M6E_AI_1.00.000019. Acer has published a mitigation advisory.

Vendor
Acer
Product
Connect M6E 5G firmware
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-06-04
Advisory published
2026-06-04
Advisory updated
2026-06-04

Who should care

Organizations deploying Acer Connect M6E 5G devices for remote connectivity, network administrators managing these devices, and security teams responsible for telecommunications infrastructure integrity.

Technical summary

The Acer Connect M6E 5G firmware implements TrustAllCerts routines that bypass standard TLS certificate chain validation. Additionally, the firmware contains hard-coded DES symmetric encryption keys. These combined weaknesses allow a MITM attacker—who must overcome the AC:H (high attack complexity) network positioning requirement—to intercept and decrypt network traffic. The vulnerability is rated CRITICAL with CVSS 4.0 score 9.2. Affected versions are firmware M6E_AI_1.00.000019 and earlier. The underlying weakness is categorized as CWE-330.

Defensive priority

critical

Recommended defensive actions

  • Apply the vendor mitigation guidance from Acer for Connect M6E 5G firmware.
  • Upgrade firmware beyond version M6E_AI_1.00.000019 when a patched release becomes available.
  • Restrict network access to affected device management interfaces and avoid untrusted networks until patched.
  • Monitor for unauthorized device configuration changes or unexpected network traffic patterns.
  • Review network segmentation to limit exposure of affected devices to potential MITM positions.

Evidence notes

NVD lists vulnStatus as Analyzed. CVSS 4.0 vector: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. CPE criteria identify affected firmware and hardware. Weakness mapped to CWE-330 (Use of Insufficiently Random Values).

Official resources

2026-06-04