CVE-2026-50213: Bulk User Private Data Harvesting

Synopsis

An unauthenticated information-disclosure vulnerability affects the Acer Connect M6E 5G Portable WiFi Router firmware at version M6E_AI_1.00.000019 and earlier. The device's /v1/User/validate endpoint is reachable over the network without any credentials and returns full user profile data; because the identifiers used to look up accounts are predictable, an attacker can iterate through them systematically to harvest records in bulk. Successful exploitation gives an attacker read access to comprehensive private user profile data for all accounts stored on the device. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Acer publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the device's /v1/User/validate endpoint across the network.

• AuthenticationNot required

  No credentials or session token of any kind are required to query the endpoint and retrieve user profile data.

• Victim interactionNot required

  The attacker queries the endpoint directly; no action from any user or administrator on the device is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; account identifiers are predictable, so automated enumeration requires no special timing, memory knowledge, or environmental setup.

Blast Radius

• An attacker reads comprehensive user profile data sheets for every account stored on the device by iterating predictable user identifiers.
• Harvested profile data may include personally identifiable information such as names, email addresses, phone numbers, or account credentials depending on what the device stores per profile.
• Because enumeration is unauthenticated and automated, bulk harvesting of all user records on an exposed device is achievable in a single scripted pass.