High severity · published Jun 4, 2026
CVE-2026-50209
MDM Server Registration Overriding
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administrative ownership to an external attacker.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Connect M6E 5G Portable WiFi Router · Acer
through M6E_AI_1.00.000019 · source: vendor
CM
Connect M6e 5g Firmware · Acer
through m6e_ai_1.00.000019 · source: NVD
Affected product
CM
Connect M6E 5G Portable WiFi Router
Acer
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50209
Mitigation
https://community.acer.com/en/kb/articles/19707
More from Connect M6E 5G Portable WiFi Router
9.8
CVE-2026-50214
Shared Secret Quota Inflation
9.8
CVE-2026-50211
Exposed Factory Testing App Boundaries
9.8
CVE-2026-49191
Exposed Hard-coded M3WebServer Backend API Key
9.8
CVE-2026-49188
Elevated Root Command Execution via ai_cmd Sockets
9.8
CVE-2026-49186
Lack of MQTT Broker Topic Access Control Lists