CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,488 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,488
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product acer:connect_m6e_5g_firmware. Show all products

26 CVEs, showing 1 to 26
CVESeverityTitlePublished
CVE-2026-49185Critical 9.8The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.Jun 4, 2026
CVE-2026-49186Critical 9.8The local MQTT broker does not enforce topic-level Access Control Lists (ACLs).Jun 4, 2026
CVE-2026-49187High 7.5The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.Jun 4, 2026
CVE-2026-49188Critical 9.8The ai_cmd utility executes with full root permissions.Jun 4, 2026
CVE-2026-49189High 7.8Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.Jun 4, 2026
CVE-2026-49190High 8.8The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.Jun 4, 2026
CVE-2026-49191Critical 9.8The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.Jun 4, 2026
CVE-2026-49192Medium 5.4The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.Jun 4, 2026
CVE-2026-49193High 7.5Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.Jun 4, 2026
CVE-2026-49194High 8.8The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.Jun 4, 2026
CVE-2026-49202High 8.6Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.Jun 4, 2026
CVE-2026-49203High 8.3Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.Jun 4, 2026
CVE-2026-49204Medium 6.5Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.Jun 4, 2026
CVE-2026-50205High 8.2System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.Jun 4, 2026
CVE-2026-50206Medium 6.8Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.Jun 4, 2026
CVE-2026-50207High 7.8The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.Jun 4, 2026
CVE-2026-50208Critical 9.4High-risk TrustAllCerts routines disable standard TLS certificate validation.Jun 4, 2026
CVE-2026-50209High 7.8Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.Jun 4, 2026
CVE-2026-50210High 7.5The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.Jun 4, 2026
CVE-2026-50211Critical 9.8Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.Jun 4, 2026
CVE-2026-50212Medium 6.5Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.Jun 4, 2026
CVE-2026-50213High 7.5The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.Jun 4, 2026
CVE-2026-50214Critical 9.8The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.Jun 4, 2026
CVE-2026-50224Medium 4.9The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.Jun 4, 2026
CVE-2026-50225Critical 9.1The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.Jun 4, 2026
CVE-2026-50226Medium 5.3Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers.Jun 4, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.