7.2
High
CVE-2026-49203 Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote…
Description
Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Connect M6E 5G Portable WiFi Router | Versions not published |
Other CVEs of Connect M6E 5G Portable WiFi Router
The 26 CVEs of Connect M6E 5G Portable WiFi Router →
CVE-2026-50226
Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for…
6.9
Medium
CVE-2026-50225
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems…
8.8
High
CVE-2026-50224
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall…
6.9
Medium
CVE-2026-50214
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary…
9.3
Critical