CVE-2026-49204— Hard-coded AWS Cognito Testing Accounts
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Acer | Connect M6E 5G Portable WiFi Router | *≤ M6E_AI_1.00.000019 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hard-coded AWS Cognito Testing Accounts
Source: NVD (National Vulnerability Database)
Vulnerability Description
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
Acer M6E 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Acer M6E是中国台湾宏碁（Acer）公司的一款便携式5G移动热点设备。 Acer M6E存在安全漏洞，该漏洞源于遗留调试模块包含内部AWS Cognito测试沙箱的固定凭据，可能导致资产被利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Acer | Connect M6E 5G Portable WiFi Router | * ~ M6E_AI_1.00.000019 | - |
II. Public POCs for CVE-2026-49204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49204
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49204 (1)
Same Patch Batch · Acer · 2026-06-04 · 26 CVEs total
| CVE-2026-50224 | Unauthenticated IPv6 WAN Management Exposure | |
| CVE-2026-50206 | VPN Command Injection Vulnerability | |
| CVE-2026-50205 | Plaintext Log Credential Leakage | |
| CVE-2026-50207 | Local Modem Manipulation via Binder Interfaces | |
| CVE-2026-50226 | Firmware Theft & IMEI Spoofing via Connect-OTA | |
| CVE-2026-50225 | Account Creation Exhaustion | |
| CVE-2026-50212 | Arbitrary Remote Device Unbinding | |
| CVE-2026-50211 | Exposed Factory Testing App Boundaries | |
| CVE-2026-50209 | MDM Server Registration Overriding | |
| CVE-2026-50210 | Weak Static Cryptographic Initialization Vectors | |
| CVE-2026-50213 | Bulk User Private Data Harvesting | |
| CVE-2026-50208 | Permissive TrustAllCerts TLS Verification | |
| CVE-2026-50214 | Shared Secret Quota Inflation | |
| CVE-2026-49203 | Unauthenticated eSIM Configuration Manipulation | |
| CVE-2026-49186 | Lack of MQTT Broker Topic Access Control Lists | |
| CVE-2026-49191 | Exposed Hard-coded M3WebServer Backend API Key | |
| CVE-2026-49189 | Broadcast Receiver Privilege Escalation | |
| CVE-2026-49190 | Missing Per-Instruction Authorization Checks | |
| CVE-2026-49192 | Summary Service Insecure Direct Object Reference | |
| CVE-2026-49202 | Unverified Meeting Recording Endpoints & Permissive CORS |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-798
- CVE-2026-5667
Information Disclosure, Information Tampering, or Denial-of- - CVE-2026-22312
Use of Hard-coded Credentials Vulnerability in Radiflow iSAP - CVE-2026-50083
Aqara hardcoded OAuth client credentials - CVE-2026-10557
Yarbo Android/iOS Mobile Application and Cloud Infrastructur - CVE-2026-11849
IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded
V. Comments for CVE-2026-49204
No comments yet