CVE-2026-50208: Permissive TrustAllCerts TLS Verification

Synopsis

This is an authentication-bypass and cryptographic-weakness vulnerability in the Acer Connect M6E 5G Portable WiFi Router. The device's firmware contains TrustAllCerts routines that disable TLS certificate validation entirely, and pairs that weakness with hard-coded DES symmetric encryption keys reachable over the network without any authentication. A network-positioned attacker who can intercept traffic between the router and a backend service can decrypt and read that traffic in full, and can inject or tamper with data in transit. No patched firmware version has been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected router's network-exposed service over the network; the vulnerability is remotely exploitable with no physical access required.

• AuthenticationNot required

  No credentials or account of any kind are required to exploit this vulnerability.

• Victim interactionNot required

  No action from a user or administrator on the target device is needed for exploitation to succeed.

• Attack complexityDetail

  Exploitation requires the attacker to be in a position to intercept traffic (a man-in-the-middle position), introducing a positioning requirement, though no race conditions or memory-layout dependencies are involved.

Blast Radius

• Reads decrypted network traffic flowing between the router and backend services, exposing credentials, session tokens, and any plaintext data in transit.
• Injects or modifies data in transit between the router and its backend, tampering with configuration commands or firmware update payloads.
• Disrupts availability of the router's network services to a limited degree (CVSS VA:L), consistent with minor service degradation rather than a full crash.