CVE-2026-49189: Broadcast Receiver Privilege Escalation

Synopsis

A privilege escalation vulnerability affects the Acer Connect M6E 5G Portable WiFi Router firmware (versions up to and including M6E_AI_1.00.000019). A core Broadcast Receiver component exposes administrative operations without enforcing access controls, allowing any local application or process on the device to invoke them without elevated privileges. Successful exploitation gives an attacker full control over device administration functions, including confidentiality, integrity, and availability of the system. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as Acer publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the device is required to trigger the vulnerable Broadcast Receiver.

• AuthenticationRequired

  A low-privilege local account or application context is sufficient; no administrator credentials are needed to invoke the unprotected administrative operations.

• Victim interactionNot required

  No user action is required; the attacker can invoke the Broadcast Receiver directly without any victim interaction.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout dependencies.

Blast Radius

• Reads sensitive device configuration data and stored credentials accessible through the exposed administrative interface.
• Modifies device settings, network configurations, and administrative state without authorization.
• Crashes or disrupts the router service, causing loss of connectivity for all clients depending on the device.
• Gains persistent administrative control over the device by abusing the unrestricted Broadcast Receiver to install or activate further payloads.