CVE-2026-50208

The device firmware contains dangerous TrustAllCerts routines that completely bypass TLS certificate verification — this makes it impossible to detect fake or untrusted certificates during network communication. At the same time, symmetric DES encryption keys are hardcoded into the firmware code (CWE-330: use of insufficiently random values). The combination of both weaknesses means that an attacker in a Man-in-the-Middle position can not only intercept the TLS session but also decrypt transmitted data using the known DES keys.

An attacker in a Man-in-the-Middle position can decrypt and read sensitive network traffic passing through the device, resulting in a breach of data confidentiality and integrity for the user.

Apply patches available from the manufacturer according to the references (https://community.acer.com/en/kb/articles/19707). Network segmentation, limiting device exposure to untrusted networks, and monitoring network traffic until updates are deployed are also recommended.

Acer Connect M6E 5G and Acer Connect M6E 5G Firmware — specific versions indicated in the manufacturer's references.