# CVE-2026-49202: Acer Connect M6E improper authentication in multimedia session archives

Source: https://junglewise.ai/threats/cve-2026-49202-acer-connect-m6e-improper-authentication-in-multimedia-session  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-49202 · Severity: info · CVSS 8.8 · Published 2026-06-04

The Acer Connect M6E 5G portable router contains a security flaw where internal meeting recordings and multimedia archives are accessible to anyone on the network without a password. Additionally, weak web security settings (CORS) could allow a malicious website to steal these recordings if a user visits the site while connected to the router. This could result in the unauthorized exposure of private conversations and sensitive session data.

Technologies: [Acer Connect M6E 5G Portable WiFi Router](https://junglewise.ai/threats/technologies/connect-m6e-5g-portable-wifi-router). Vendors: [Acer](https://junglewise.ai/threats/vendors/acer).

## Quick answers

**Is CVE-2026-49202 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49202 being exploited in the wild.

**How severe is CVE-2026-49202?** Informational severity, with a CVSS score of 8.8, published 4 June 2026.

**Which products and versions are affected?** Acer Connect M6E 5G Portable WiFi Router M6E_AI_1.00.000019 and earlier.

**Is there a fix for CVE-2026-49202?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49202 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-49202?** Check whether you run Acer Connect M6E 5G Portable WiFi Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Acer Connect M6E 5G router suffers from improper authentication (CWE-287) in its multimedia session archive endpoints. Internal meeting recordings are stored in a manner that does not require a valid session or credentials for access. This is further compounded by overly permissive Cross-Origin Resource Sharing (CORS) policies, which allow an attacker to perform cross-site data theft if a victim's browser interacts with a malicious origin while connected to the router's local network. Attackers can remotely access and download these archives without any prior authorization. Acer is developing a firmware update to implement signed download links and restricted CORS headers.

## Affected products

- Acer Connect M6E 5G Portable WiFi Router M6E_AI_1.00.000019 and earlier

## Timeline

- 2026-06-04: disclosed: CVE published and Acer advisory released

## References

- [https://community.acer.com/en/kb/articles/19707](https://community.acer.com/en/kb/articles/19707)

## Related threats

- [Acer Connect M6E hard-coded AES keys in OTA application](https://junglewise.ai/threats/cve-2026-50226-acer-connect-m6e-hard-coded-aes-keys-in-ota-application)
- [Acer Connect M6E missing bot mitigation in registration endpoint](https://junglewise.ai/threats/cve-2026-50225-acer-connect-m6e-missing-bot-mitigation-in-registration-endpoint)
- [Acer Connect M6E 5G Router Information Exposure in Web Admin Panel](https://junglewise.ai/threats/cve-2026-50224-acer-connect-m6e-5g-router-information-exposure-in-web-admin)
- [Acer Connect M6E shared global API token in /v1/Plan service](https://junglewise.ai/threats/cve-2026-50214-acer-connect-m6e-shared-global-api-token-in-v1-plan-service)
- [Acer Connect M6E IDOR in account validation endpoint](https://junglewise.ai/threats/cve-2026-50213-acer-connect-m6e-idor-in-account-validation-endpoint)