CVE-2026-50212: Arbitrary Remote Device Unbinding

Synopsis

This is an unauthenticated denial-of-service vulnerability in the Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier). Weak input validation in the device dissociation API allows an attacker on the same local network to forcibly unbind endpoints belonging to other users, requiring no credentials or victim interaction. Successful exploitation causes severe disruption to device availability, effectively knocking connected clients offline. No fix version has been published yet; HarborGuard tracks this advisory for patch availability and will surface a patched-image rebuild as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network (LAN, Wi-Fi segment, or VPN) as the target device; remote internet-based exploitation is not possible with this vector.

• AuthenticationNot required

  No account credentials or session tokens are needed; the vulnerable API endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attacker does not need any user to click a link or take any action; the exploit is sent directly to the device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layouts, or environmental dependencies are required.

Blast Radius

• Crashes or disrupts the availability of the targeted router's device-association service, taking it offline.
• Forcibly unbinds connected client endpoints, severing active network sessions for all affected users on the segment.
• Sustained exploitation can prevent clients from re-associating, extending the denial-of-service beyond the initial attack.