CVE-2026-49190: Missing Per-Instruction Authorization Checks

Synopsis

Missing per-instruction authorization is an access control vulnerability in the Acer Connect M6E 5G Portable WiFi Router (firmware version M6E_AI_1.00.000019 and earlier). The flaw is reachable over the network by any low-privilege account, with no victim interaction required, because the router fails to verify whether the caller is permitted to invoke specific internal operation codes (opcodes). Successful exploitation lets an attacker install unauthorized applications or execute arbitrary commands on the device. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is exposed over the network, meaning an attacker must be able to reach the router's management interface across the network to send crafted opcode requests.

• AuthenticationRequired

  A low-privilege account is sufficient to trigger the flaw; full administrative credentials are not needed, but the attacker must hold at least some valid credential on the device.

• Victim interactionNot required

  No action from a legitimate user or administrator is needed; the attacker can exploit the device entirely on their own once network access and credentials are available.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup beyond network access and a valid low-privilege account.

Blast Radius

• Reads sensitive configuration data, credentials stored on the device, and network traffic passing through the router.
• Modifies router configuration, routing rules, or firewall policies, potentially redirecting or intercepting traffic from all connected clients.
• Installs unauthorized applications or persistent backdoors on the router firmware, surviving reboots.
• Crashes or destabilizes the router service, disrupting network connectivity for all clients depending on the device.