CVE-2026-49191: Exposed Hard-coded M3WebServer Backend API Key

Synopsis

A hard-coded API key exposure vulnerability affects the Acer Connect M6E 5G Portable WiFi Router running M3WebServer firmware version M6E_AI_1.00.000019 and earlier. The vulnerability is reachable over the network with no authentication required, and the embedded API keys are trivially recoverable via verbose error pages served by the device. Successful exploitation gives an attacker full authenticated access to the backend API, enabling data disclosure, configuration tampering, and service disruption. No fix version has been published; HarborGuard tracks the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the M3WebServer interface over the network; the device's web server is exposed on the local or wide-area network interface.

• AuthenticationNot required

  No credentials are needed; the hard-coded API key is recoverable from unauthenticated error response pages served by the device.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server without involving a victim.

• Attack complexityDetail

  Exploit complexity is low; no race conditions or special environmental factors are required to retrieve the hard-coded key from verbose error pages.

Blast Radius

• Attacker recovers the hard-coded backend API key and gains fully authenticated access to the M3WebServer backend API.
• Attacker reads device configuration, connected-client data, and any credentials or session tokens accessible via the API.
• Attacker modifies router configuration, including network settings, firewall rules, and DNS entries, affecting all clients routed through the device.
• Attacker disrupts or disables the router service, cutting network connectivity for all devices relying on it.