CVE-2026-49192

Summary Service Insecure Direct Object Reference

CVSS 5.3 MEDIUMEPSS 0.1%CWE-639

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

04 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Affected products

Acer · Connect M6E 5G Portable WiFi Router

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://community.acer.com/en/kb/articles/19707