CVE-2026-49202: Unverified Meeting Recording Endpoints & Permissive CORS

Synopsis

An authentication bypass and permissive CORS misconfiguration affects the Acer Connect M6E 5G Portable WiFi Router at firmware version M6E_AI_1.00.000019 and earlier. The vulnerability is reachable over the network without any credentials, and loose Cross-Origin Resource Sharing rules allow a malicious web page to silently retrieve data from the device on behalf of a visiting user. Successful exploitation gives an attacker read access to internal multimedia session archives, including stored meeting recordings. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Acer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web interface over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials of any kind are required to access the vulnerable recording endpoints.

• Victim interactionNot required

  No victim action is needed for direct endpoint access; however, the permissive CORS rules create a secondary path where a user simply visiting a malicious page triggers cross-origin retrieval without any deliberate interaction beyond the page visit.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, special memory layout, or environment-specific configuration is required.

Blast Radius

• Reads stored multimedia session archives and meeting recordings held on the device without any login.
• Exploits permissive CORS rules to pull recording data from the device through the browser of any user on the same network who visits an attacker-controlled page.
• Exposes metadata embedded in session archives, which may include participant identifiers, timestamps, and session content.
• Allows limited tampering with device state (CVSS VI:L), which may permit an attacker to alter session indices or overwrite limited records.