CVE-2026-50209: MDM Server Registration Overriding

Synopsis

An authentication-bypass-style privilege escalation vulnerability affects the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier). A local, low-privileged attacker can send broadcast events to overwrite the device's Mobile Device Management (MDM) endpoint address, transferring administrative ownership to an external party. Successful exploitation gives the attacker full administrative control over device configuration, data, and availability. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required to trigger the broadcast event.

• AuthenticationRequired

  A low-privilege local account is sufficient; no administrative credentials are needed to issue the malicious broadcast.

• Victim interactionNot required

  The attack executes without any action from another user or administrator on the device.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental factors are required.

Blast Radius

• The attacker redirects the MDM enrollment endpoint, transferring administrative ownership of the device to an external server they control.
• Full read access to device configuration, stored credentials, and session state is granted to the attacker-controlled MDM server.
• The attacker can modify persisted device settings, push arbitrary configuration profiles, and alter routing behavior on the portable WiFi router.
• The attacker can render the device unmanageable by its legitimate owner or crash management services entirely, disrupting connectivity for all users on the router.