CVE-2026-50214: Shared Secret Quota Inflation

Synopsis

An authentication bypass vulnerability in the Acer Connect M6E 5G Portable WiFi Router allows any network-reachable attacker to reach the /v1/Plan service administrative endpoint without credentials. The service relies on a shared global API token that is not enforced per-user, meaning no login or privilege is required to issue full administrative commands. Successful exploitation lets an attacker create arbitrary zero-cost network access plans, effectively granting free or unlimited network access and tampering with billing and quota data. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The /v1/Plan endpoint is exposed over the network, so an attacker must be able to reach the router's HTTP service, either from the local network segment or any routable path to the device.

• AuthenticationNot required

  The service uses a shared global API token rather than per-user authentication, meaning no valid account or credential is needed to issue administrative commands.

• Victim interactionNot required

  The attacker sends requests directly to the endpoint; no user action, click, or session is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and reliable with no race conditions, memory layout dependencies, or other environmental prerequisites to satisfy.

Blast Radius

• Reads and enumerates all existing network access plans, exposing pricing and quota configuration data.
• Creates arbitrary zero-cost network access plans, allowing free or unlimited network access without payment.
• Modifies billing and quota state for the router, undermining the integrity of any metered or managed access controls.
• Disrupts legitimate plan management by flooding the plan database or overwriting existing plan records.