CVE-2026-50211: Acer Connect M6E 5G Exposed Factory Diagnostics
Leftover engineering and factory-level diagnostic software remain on retail builds of the Acer Connect M6E 5G, according to the record. The record states that malicious apps could gain write privileges to internal NVRAM registers. The sources consulted do not show confirmed exploitation, and a vendor mitigation article is referenced.
Overview
The record for CVE-2026-50211 describes leftover engineering diagnostics and factory-level diagnostic software that remain exposed on retail builds of the Acer Connect M6E 5G firmware and router. The weakness is classified as CWE-134, use of externally-controlled format string. The record was published on 2026-06-04 by the CNA Acer.
Impact
- The record states that malicious apps could gain write privileges to internal NVRAM registers.
- NVD assigns a CVSS score of 9.8 (critical), while the CNA Acer assigns a score of 8.8 under a newer CVSS revision.
- The SSVC data in the record lists exploitation as none, automatable as yes and technical impact as partial.
Affected products and versions
- Acer Connect M6E 5G firmware, up to and including 00.000019 according to the record.
- Acer Connect M6E 5G Portable WiFi Router, up to and including 00.000019 according to the record.
- The record does not list any fixed version.
Exploitation status
The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00522, with a percentile of 0.43472.
Remediation and mitigation
- The record references a vendor mitigation article from Acer Community (article 19707), typed as a mitigation. Review that article and follow the vendor guidance.
- Inventory devices running firmware up to and including 00.000019 and prioritize those that are used in sensitive environments.
- Limit the installation of untrusted apps on managed devices and keep app installation controls enabled.
- Confirm with Acer whether a firmware update removes the exposed diagnostic components before considering the issue closed.
Detection guidance
- Track firmware versions across the device fleet so exposed builds are identified quickly.
- Monitor for unexpected application behavior or configuration changes on affected devices, at a high level, using existing endpoint or device management tooling.
- Review vendor advisories for indicators or recommended checks that the record does not describe.
Limitations of the available information
- The record does not identify the specific diagnostic components, their function or the exact NVRAM registers involved.
- No fixed version is stated, and the mitigation article content was not available in the record.
- The affected version strings in the record use a different product-prefixed format, so only the allowed version endpoint is given here.
- The EPSS date in the record is later than the publication date and should be verified against the current EPSS data.
Frequently asked questions
What is CVE-2026-50211?
It is a record describing leftover engineering and factory-level diagnostic software exposed on retail builds of the Acer Connect M6E 5G firmware and router, classified as CWE-134.
Which versions are affected according to the record?
The record lists versions up to and including 00.000019 for both the firmware and the Portable WiFi Router. It does not list a fixed version.
Is this vulnerability being actively exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Review the vendor mitigation article referenced in the record, inventory affected devices, limit untrusted app installations, and confirm with Acer when a fix is available.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.