CVE-2026-49193: Publicly Readable AWS S3 Telemetry Buckets

Synopsis

This is an information-disclosure vulnerability in the Acer Connect M6E 5G Portable WiFi Router caused by overly permissive AWS S3 bucket configurations that expose active telemetry data publicly over the internet. No authentication is required to reach the affected storage, and the vulnerability is exploitable by any internet-connected client without any user interaction. Successful exploitation allows an attacker to read telemetry information produced by affected devices. No fix version has been published; HarborGuard tracks this advisory and will flag a patched-image rebuild as soon as upstream ships a remediation.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable S3 buckets are exposed directly over the internet, so an attacker must be able to reach them via a standard network connection.

• AuthenticationNot required

  No credentials or account of any kind are needed; the buckets are publicly readable by any internet client.

• Victim interactionNot required

  Exploitation is entirely passive from the attacker's perspective and requires no action by any user or device owner.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or environmental dependencies required.

Blast Radius

• An attacker reads live telemetry data emitted by affected Acer Connect M6E routers, which may include network usage patterns, device identifiers, and connectivity metadata.
• Depending on telemetry scope, the exposed data may reveal internal network topology details or user behavioral patterns tied to the device.
• Confidentiality of all telemetry stored in the affected buckets is fully compromised; there is no partial-read limitation once the bucket is reached.