9.3
Critique
CVE-2026-50214 The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary…
Description
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Connect M6E 5G Portable WiFi Router | Versions non publiées |
Autres CVE de Connect M6E 5G Portable WiFi Router
Les 26 CVE de Connect M6E 5G Portable WiFi Router →
CVE-2026-50226
Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for…
6.9
Moyenne
CVE-2026-50225
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems…
8.8
Élevée
CVE-2026-50224
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall…
6.9
Moyenne
CVE-2026-50213
The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled…
8.7
Élevée