CVE-2026-50225: Acer Connect M6E 5G - Account Registration Lacks Bot Mitigation
CVE-2026-50225 affects the account registration endpoint of Acer Connect M6E 5G products, which provides no bot mitigation and can be flooded by automated systems. The weakness is classified as CWE-306 (Missing Authentication for Critical Function), and NVD assigns a CVSS base score of 9.1. Acer's referenced material is a mitigation article, and this CVE is not listed in the CISA KEV catalog.
Overview
CVE-2026-50225 describes missing bot mitigation on the account registration path /v1/account/register in Acer Connect M6E 5G products. According to the record, automated systems can use this path to create accounts in bulk and fill the backing database. The associated weakness is CWE-306 (Missing Authentication for Critical Function).
Impact
NVD assigns a CVSS base score of 9.1 with high integrity and availability impact and no confidentiality impact. The CNA, Acer, provides a score of 8.8 under a second scoring system. Flooding the database may degrade availability and data integrity. The real-world impact depends on the deployment, which the record does not describe.
Affected products and versions
- Acer Connect M6e 5G Firmware: listed in the record as affected up to and including 00.000019.
- Acer Connect M6E 5G Portable WiFi Router: listed in the record as affected up to and including 00.000019.
The record gives 00.000019 as the only version endpoint for both products. No lower bound is stated.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record, so no active exploitation is claimed. No confirmed exploitation appears in the sources consulted. The SSVC data in the record indicates exploitation as none and automatable as yes.
Remediation and mitigation
- The record references a mitigation from Acer's community knowledge base: Acer community article. Review it for vendor guidance.
- The record does not identify a fixed firmware version. Confirm with Acer whether a firmware update exists for your model.
- Until a fix is confirmed, limit exposure of the registration endpoint to trusted networks and apply rate limiting and bot-detection controls in front of it.
Detection guidance
- Monitor registration volume for unusual spikes, repeated requests from the same sources, or bursts of new accounts with similar patterns.
- Track database growth and account table size as indicators of abuse.
Limitations of the available information
The record does not state a fixed version, the exact conditions required for abuse, or whether a vendor patch exists. It does not describe the authentication configuration of the registration path beyond the absence of bot mitigation. Scores come from NVD and the CNA and may be revised.
Frequently asked questions
What is CVE-2026-50225?
It is a vulnerability in Acer Connect M6E 5G products where the account registration path provides no bot mitigation, allowing automated systems to flood the database.
Is this vulnerability being actively exploited?
This CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record does not identify a fixed version. It references a mitigation article from Acer, so check that article and confirm update availability with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.