CVE-2026-49203 Unauthenticated eSIM Configuration Manipulation

What is CVE-2026-49203?

CVE-2026-49203 is a high-severity missing authorization vulnerability in Acer Connect M6E 5G Portable WiFi Router, published on 4 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

Weakness: CWE-287

Which versions are affected by CVE-2026-49203?

It affects 1 product.

Products include Acer Connect M6e 5g Firmware.

How do I fix CVE-2026-49203?

No fix has been published for CVE-2026-49203 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-49203 being exploited?

There is no known exploitation of CVE-2026-49203 in the wild and no public exploit code.

Other vulnerabilities in Acer Connect M6E 5G Portable WiFi Router

• CVE-2026-49185 Instruction Injection via FieldX MDM Critical 10.0
• CVE-2026-49190 Missing Per-Instruction Authorization Checks Critical 9.4
• CVE-2026-49194 SCREEN_CLICK Authentication Bypass Critical 9.4
• CVE-2026-49191 Exposed Hard-coded M3WebServer Backend API Key Critical 9.3
• CVE-2026-50209 MDM Server Registration Overriding Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hhrg-xw9w-2f4q.