# CVE-2026-50225: Acer Connect M6E missing bot mitigation in registration endpoint

Source: https://junglewise.ai/threats/cve-2026-50225-acer-connect-m6e-missing-bot-mitigation-in-registration-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-50225 · Severity: info · CVSS 8.8 · Published 2026-06-04

The Acer Connect M6E 5G portable router contains a vulnerability in its account registration process that lacks protection against automated bots. This allows malicious actors to use automated scripts to create a massive number of fake accounts, potentially overwhelming the device's database and causing service disruptions. This could lead to a denial-of-service condition where legitimate users are unable to manage their devices or access services.

Technologies: [Acer Connect M6E 5G Portable WiFi Router](https://junglewise.ai/threats/technologies/connect-m6e-5g-portable-wifi-router). Vendors: [Acer](https://junglewise.ai/threats/vendors/acer).

## Quick answers

**Is CVE-2026-50225 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50225 being exploited in the wild.

**How severe is CVE-2026-50225?** Informational severity, with a CVSS score of 8.8, published 4 June 2026.

**Which products and versions are affected?** Acer Connect M6E 5G Portable WiFi Router M6E_AI_1.00.000019 or earlier.

**Is there a fix for CVE-2026-50225?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50225 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50225?** Check whether you run Acer Connect M6E 5G Portable WiFi Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The registration path /v1/account/register in Acer Connect M6E firmware (up to version M6E_AI_1.00.000019) does not implement rate limiting, CAPTCHAs, or other bot mitigation mechanisms. This is classified as a missing authentication for a critical function (CWE-306). A remote, unauthenticated attacker can exploit this by sending a high volume of automated registration requests to the device. This can lead to database exhaustion or a denial-of-service (DoS) affecting the availability of the management interface. Acer has indicated that remediation involves implementing request-rate throttling and dynamic validation.

## Affected products

- Acer Connect M6E 5G Portable WiFi Router M6E_AI_1.00.000019 or earlier

## Timeline

- 2026-06-04: disclosed: Initial publication of CVE-2026-50225 and Acer security advisory.

## References

- [https://community.acer.com/en/kb/articles/19707](https://community.acer.com/en/kb/articles/19707)

## Related threats

- [Acer Connect M6E hard-coded AES keys in OTA application](https://junglewise.ai/threats/cve-2026-50226-acer-connect-m6e-hard-coded-aes-keys-in-ota-application)
- [Acer Connect M6E 5G Router Information Exposure in Web Admin Panel](https://junglewise.ai/threats/cve-2026-50224-acer-connect-m6e-5g-router-information-exposure-in-web-admin)
- [Acer Connect M6E shared global API token in /v1/Plan service](https://junglewise.ai/threats/cve-2026-50214-acer-connect-m6e-shared-global-api-token-in-v1-plan-service)
- [Acer Connect M6E IDOR in account validation endpoint](https://junglewise.ai/threats/cve-2026-50213-acer-connect-m6e-idor-in-account-validation-endpoint)
- [Acer Connect M6E 5G Router denial of service in dissociation API](https://junglewise.ai/threats/cve-2026-50212-acer-connect-m6e-5g-router-denial-of-service-in-dissociation-api)