CVE-2026-50224— Unauthenticated IPv6 WAN Management Exposure
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Acer | Connect M6E 5G Portable WiFi Router | *≤ M6E_AI_1.00.000019 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50224
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated IPv6 WAN Management Exposure
Source: NVD (National Vulnerability Database)
Vulnerability Description
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Acer M6E 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Acer M6E是中国台湾宏碁（Acer）公司的一款便携式5G移动热点设备。 Acer M6E存在安全漏洞，该漏洞源于Web管理面板广泛绑定到公共IPv6地址空间的端口[::]:8080且无默认防火墙限制，可能导致内部API端点通过广域网可达。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Acer | Connect M6E 5G Portable WiFi Router | * ~ M6E_AI_1.00.000019 | - |
II. Public POCs for CVE-2026-50224
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50224
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-50224 (1)
Same Patch Batch · Acer · 2026-06-04 · 26 CVEs total
| CVE-2026-49186 | Lack of MQTT Broker Topic Access Control Lists | |
| CVE-2026-50206 | VPN Command Injection Vulnerability | |
| CVE-2026-50205 | Plaintext Log Credential Leakage | |
| CVE-2026-50207 | Local Modem Manipulation via Binder Interfaces | |
| CVE-2026-50226 | Firmware Theft & IMEI Spoofing via Connect-OTA | |
| CVE-2026-50225 | Account Creation Exhaustion | |
| CVE-2026-50212 | Arbitrary Remote Device Unbinding | |
| CVE-2026-50211 | Exposed Factory Testing App Boundaries | |
| CVE-2026-50209 | MDM Server Registration Overriding | |
| CVE-2026-50210 | Weak Static Cryptographic Initialization Vectors | |
| CVE-2026-50213 | Bulk User Private Data Harvesting | |
| CVE-2026-50208 | Permissive TrustAllCerts TLS Verification | |
| CVE-2026-50214 | Shared Secret Quota Inflation | |
| CVE-2026-49204 | Hard-coded AWS Cognito Testing Accounts | |
| CVE-2026-49191 | Exposed Hard-coded M3WebServer Backend API Key | |
| CVE-2026-49189 | Broadcast Receiver Privilege Escalation | |
| CVE-2026-49190 | Missing Per-Instruction Authorization Checks | |
| CVE-2026-49192 | Summary Service Insecure Direct Object Reference | |
| CVE-2026-49202 | Unverified Meeting Recording Endpoints & Permissive CORS | |
| CVE-2026-49194 | SCREEN_CLICK Authentication Bypass |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-200
- CVE-2026-12111
Appointment Booking Calendar <= 1.4.01 - Authenticated (Cont - CVE-2026-11357
Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensi - CVE-2026-12120
FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Informat - CVE-2026-50200
Steeltoe's env sanitizer misses connection strings — leaks e - CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerab
V. Comments for CVE-2026-50224
No comments yet