CVE-2026-50226 — Firmware Theft & IMEI Spoofing via Connect-OTA

CVE-2026-50226

Firmware Theft & IMEI Spoofing via Connect-OTA PUBLISHED

Description (CNA)

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.

Affected (CNA)

Vendor / product	Versions
Acer / Connect M6E 5G Portable WiFi Router	affected * through M6E_AI_1.00.000019

CWE

CWE-321

References

https://community.acer.com/en/kb/articles/19707

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.