# CVE-2026-49189: Acer Connect M6E Broadcast Receiver privilege escalation

Source: https://junglewise.ai/threats/cve-2026-49189-acer-connect-m6e-broadcast-receiver-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-49189 · Severity: info · CVSS 8.5 · Published 2026-06-04

A vulnerability in the Acer Connect M6E 5G portable router allows unauthorized local software to perform administrative tasks. This occurs because a core communication component lacks proper access controls, potentially allowing a malicious app on a connected device to change system settings. An exploit could lead to unauthorized configuration changes or a compromise of the router's management functions.

Technologies: [Acer Connect M6E 5G Portable WiFi Router](https://junglewise.ai/threats/technologies/connect-m6e-5g-portable-wifi-router). Vendors: [Acer](https://junglewise.ai/threats/vendors/acer).

## Quick answers

**Is CVE-2026-49189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49189 being exploited in the wild.

**How severe is CVE-2026-49189?** Informational severity, with a CVSS score of 8.5, published 4 June 2026.

**Which products and versions are affected?** Acer Connect M6E 5G Portable WiFi Router M6E_AI_1.00.000019 or earlier.

**Is there a fix for CVE-2026-49189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49189 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-49189?** Check whether you run Acer Connect M6E 5G Portable WiFi Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation (CWE-269) within the Android-based firmware of the Acer Connect M6E 5G router. A core Broadcast Receiver is exported with public access permissions but lacks proper validation of the calling component. A local attacker or a malicious application on the device can send intents to this receiver to trigger administrative operations without authorization. Acer recommends updating firmware to versions that set 'exported=false' or enforce signature-level permissions for this component.

## Affected products

- Acer Connect M6E 5G Portable WiFi Router M6E_AI_1.00.000019 or earlier

## Timeline

- 2026-06-04: disclosed
- 2026-06-04: advisory

## References

- [https://community.acer.com/en/kb/articles/19707](https://community.acer.com/en/kb/articles/19707)

## Related threats

- [Acer Connect M6E hard-coded AES keys in OTA application](https://junglewise.ai/threats/cve-2026-50226-acer-connect-m6e-hard-coded-aes-keys-in-ota-application)
- [Acer Connect M6E missing bot mitigation in registration endpoint](https://junglewise.ai/threats/cve-2026-50225-acer-connect-m6e-missing-bot-mitigation-in-registration-endpoint)
- [Acer Connect M6E 5G Router Information Exposure in Web Admin Panel](https://junglewise.ai/threats/cve-2026-50224-acer-connect-m6e-5g-router-information-exposure-in-web-admin)
- [Acer Connect M6E shared global API token in /v1/Plan service](https://junglewise.ai/threats/cve-2026-50214-acer-connect-m6e-shared-global-api-token-in-v1-plan-service)
- [Acer Connect M6E IDOR in account validation endpoint](https://junglewise.ai/threats/cve-2026-50213-acer-connect-m6e-idor-in-account-validation-endpoint)