CVE-2026-49187: Hard-coded APK Resource Credentials & Scepters

Synopsis

A hard-coded credentials vulnerability affects the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier). The flaw is reachable over the network with no authentication required, exposing APK resource credentials and shared scepter tokens that never expire. Successful exploitation gives an attacker read access to sensitive configuration or authentication material, enabling information disclosure and potential misuse of the exposed credentials. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Acer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network, meaning an attacker must be able to reach it remotely with no requirement for physical or adjacent-network access.

• AuthenticationNot required

  No credentials or prior account access are needed; the hard-coded resource files and shared scepter are accessible to any unauthenticated caller.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a legitimate user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental pre-conditions to succeed.

Blast Radius

• Attacker reads hard-coded APK resource credentials that never expire, gaining persistent access to the exposed authentication material.
• Attacker obtains the shared scepter token and can reuse it to impersonate authorized clients or access protected router functionality.
• Exposed credentials may be leveraged to enumerate router configuration details, including connected device information or network topology.