These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The AcerConnect OTA application had a security issue (CVE-2026-50226) where fixed AES-128-CBC keys were used, allowing attackers to forge authorization credentials for any IMEI number. This vulnerability, with a CVSS score of 6.9, enabled unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.
CVE-2026-50225 is a HIGH severity vulnerability with a CVSS score of 8.8. The vulnerability exists in the registration path /v1/account/register, which provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database. The vulnerability was published on [cvePublishedAt]2026-06-04T10:16:40.123Z[/cvePublishedAt] and modified on [cveModifiedAt]2026-06-08T12:58:13.150Z[/cveModifiedAt].
The CVE-2026-50224 vulnerability affects the Acer Connect M6E 5G product. The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN. This issue has a CVSS score of 6.9 and is classified as MEDIUM severity.
CVE-2026-50214 is a critical vulnerability with a CVSS score of 9.3, affecting the /v1/Plan service, which relies entirely on a shared global API token for full administrative management. This allows for arbitrary creation of zero-cost network access plans. The vulnerability was published on 2026-06-04T10:16:39.850Z and modified on 2026-06-08T12:56:12.743Z.
CVE-2026-50213 is a high-severity vulnerability with a CVSS score of 8.7. The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings. This issue was published on 2026-06-04T09:16:29.987Z and last modified on 2026-06-04T19:10:08.420Z.
CVE-2026-50212 is a HIGH severity vulnerability with a CVSS score of 7.1. The vulnerability is caused by weak validation logic within device dissociation API routines, allowing a remote entity to forcefully unbind unrelated user endpoints, resulting in a severe denial of service.
A high-severity vulnerability, CVE-2026-50211, was discovered in Acer Connect M6E 5G firmware. The vulnerability has a CVSS score of 8.8 and allows malicious apps to gain write privileges to internal NVRAM registers due to leftover engineering diagnostics and factory-level diagnostic software exposed on retail builds.
CVE-2026-50210 is a vulnerability in Acer Connect M6E 5G firmware. The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption. This vulnerability has a CVSS score of 6.9 and a severity of MEDIUM.
A critical vulnerability in Acer Connect M6E 5G firmware allows malicious software on the device to intercept and exploit broadcast events, rewriting the default Mobile Device Management (MDM) endpoint address. This redirects administrative control to an attacker-controlled server, effectively transferring device ownership. The flaw is rated CVSS 4.0 critical with high impacts across confidentiality, inte [truncated]
Acer Connect M6E 5G firmware contains critical TLS security weaknesses. TrustAllCerts routines disable standard certificate validation, and hard-coded DES symmetric encryption keys are present. A network-positioned attacker could exploit these flaws in a Man-in-the-Middle (MITM) scenario to decrypt network traffic. The vulnerability affects Connect M6E 5G firmware versions up to and including M6E_AI_1.00. [truncated]
A local privilege escalation vulnerability in Acer Connect M6E 5G firmware allows authenticated local attackers to send unverified AT commands through the Binder interface. The flaw enables reading baseband files or disabling cellular connectivity. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), though the description indicates an AT command injecti [truncated]
Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.
A command injection vulnerability exists in a Wi-Fi device blocking feature due to insufficient sanitization of MAC address input. An attacker with high privileges can inject and execute arbitrary shell commands by supplying a crafted MAC address. The vulnerability is rated HIGH severity with a CVSS score of 8.6. The affected vendor is identified as Acer based on reference domain evidence, though this att [truncated]
An unauthenticated debug service vulnerability exposes the /sbin/mtk_dut binary on TCP port 9000, allowing any LAN-based attacker to execute arbitrary UCC commands without authentication. The vulnerability carries a HIGH severity CVSS score of 8.7. The vendor attribution to Acer is based on a reference domain candidate with low confidence and requires review. The CVE was published on 2026-05-29 and remain [truncated]
A local privilege escalation vulnerability in Acer NitroSense software versions prior to 3.01.3052 allows authenticated low-privileged users to delete arbitrary files with SYSTEM privileges. The PSAdminAgent service creates a Named Pipe with a weak Access Control List (ACL), permitting any authenticated local user to connect and send commands. The service fails to validate caller privileges before executi [truncated]
A local denial-of-service vulnerability exists in Acer Care Center's ACCSvc service. The service creates a Named Pipe with a weak Security Descriptor, allowing an authenticated local user to connect and send a specially crafted message (type 0x03) that causes the service to terminate with exit code 1067 (ERROR_PROCESS_ABORTED). This vulnerability requires local access and valid user credentials, limiting [truncated]
NitroSense 3.x before 3.01.3052 contains a Local Privilege Escalation (LPE) vulnerability. The application exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. This Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an att [truncated]