CVE-2026-50207: Local Modem Manipulation via Binder Interfaces

Synopsis

An authentication-bypass and improper-input-validation flaw exists in the Binder interface layer of the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier). A locally-running application with low-privilege access can send unverified AT commands through the Binder boundary without any further authorization check. Successful exploitation lets an attacker read baseband files or disable cellular connectivity entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Acer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the device is required.

• AuthenticationRequired

  Any low-privilege local account or application context is sufficient to send AT commands through the Binder interface.

• Victim interactionNot required

  No user interaction is needed; the attacker can exercise the vulnerable Binder interface directly from a local process.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to reach the vulnerable code path.

Blast Radius

• Reads baseband files stored on the device, potentially exposing modem configuration, credentials, or diagnostic data.
• Disables cellular connectivity, cutting off all mobile network access for users depending on the router.
• Tampers with modem state through unverified AT commands, allowing persistent reconfiguration of baseband behavior.
• Combines file-read and connectivity-disruption primitives to support broader lateral attacks against the device or its connected clients.