CVE-2026-50208: Acer Connect M6E 5G Router: Permissive TLS Certificate Validation
Acer Connect M6E 5G products are affected by TrustAllCerts routines that disable standard TLS certificate validation, combined with hard-coded DES keys. According to the record, a Man-in-the-Middle attacker could decrypt network traffic. The vendor lists a mitigation, but the record does not identify a fixed version.
Overview
CVE-2026-50208 describes TrustAllCerts routines in Acer Connect M6E 5G products that disable standard TLS certificate validation. The record also reports hard-coded DES symmetric encryption keys. The CNA is Acer and the record was analyzed by NVD.
Impact
The record states that a Man-in-the-Middle actor could decrypt network traffic. Disabling certificate validation weakens the assurance that a connection is established with the intended server, and fixed DES keys remove the secrecy that the encryption should provide. NVD assigns a CVSS 9.4 critical base score, while the record lists two 4.0 scores of 9.2 from other providers.
Affected products and versions
- Acer Connect M6E 5G Firmware, up to and including 00.000019
- Acer Connect M6E 5G Portable WiFi Router, up to and including 00.000019
The record gives the affected range as up to and including the version listed above. It does not provide a fixed version.
Exploitation status
The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00236 (percentile 0.13843), and the SSVC exploitation value is none with automatable set to no.
Remediation and mitigation
The record links a vendor mitigation article from Acer. Administrators should review that article, follow the vendor guidance for the affected devices, and check for firmware updates through official Acer channels. Because no fixed version is identified in the record, confirm the current firmware level and the vendor status before treating a device as protected.
- Restrict administrative access to the device and limit exposure of the router management interface.
- Avoid using these devices to protect sensitive traffic on untrusted networks until the vendor guidance is applied.
- Consider replacing affected devices if the vendor does not provide a fix.
Detection guidance
At a high level, review inventories for the affected Acer models and firmware levels. Monitor for unexpected changes in firmware, configuration, or network behavior on these devices. Network teams can also look for TLS sessions from these devices that present unexpected certificates or fail to show normal validation behavior.
Limitations of the available information
The record does not describe the exact code paths, the conditions required for interception, or the affected hardware revisions beyond the listed products. It does not provide a fixed version, and the vendor article content was not part of the record. The CWE assigned in the record is CWE-330, which concerns insufficiently random values, so the classification may not fully reflect the TLS validation issue described; this is an inference.
Frequently asked questions
What does CVE-2026-50208 affect?
The record lists Acer Connect M6E 5G Firmware and the Acer Connect M6E 5G Portable WiFi Router, up to and including 00.000019.
Is there a fixed version available?
The record does not identify a fixed version. It lists a vendor mitigation article from Acer, so check that article and official Acer channels for current guidance.
Is this vulnerability known to be exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.