CVE-2026-49192 - Vulnerability Details - OpenCVE

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00038.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://community.acer.com/en/kb/articles/19707

History

Thu, 04 Jun 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 04 Jun 2026 07:15:00 +0000

Type	Values Removed	Values Added
Description		The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.
Title		Summary Service Insecure Direct Object Reference
Weaknesses		CWE-639
References		https://community.acer.com/en/kb/articles/19707
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Acer

Published: 2026-06-04T05:43:55.875Z

Updated: 2026-06-04T12:35:37.028Z

Reserved: 2026-05-28T02:46:15.561Z

Link: CVE-2026-49192

Vulnrichment

Updated: 2026-06-04T12:35:33.788Z

NVD

Status : Received

Published: 2026-06-04T07:16:27.153

Modified: 2026-06-04T07:16:27.153

Link: CVE-2026-49192

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-04T08:30:09Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49192", "assignerOrgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "state": "PUBLISHED", "assignerShortName": "Acer", "dateReserved": "2026-05-28T02:46:15.561Z", "datePublished": "2026-06-04T05:43:55.875Z", "dateUpdated": "2026-06-04T12:35:37.028Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "shortName": "Acer", "dateUpdated": "2026-06-04T05:43:55.875Z"}, "title": "Summary Service Insecure Direct Object Reference", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639: Probe System Files"}]}], "affected": [{"vendor": "Acer", "product": "Connect M6E 5G Portable WiFi Router", "versions": [{"status": "affected", "version": "*", "lessThanOrEqual": "M6E_AI_1.00.000019", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping."}]}], "references": [{"url": "https://community.acer.com/en/kb/articles/19707"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Ta-Lun Yen", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T12:35:30.499644Z", "id": "CVE-2026-49192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:35:37.028Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T12:35:30.499644Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:35:33.788Z"}}], "cna": {"title": "Summary Service Insecure Direct Object Reference", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ta-Lun Yen"}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639: Probe System Files"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Acer", "product": "Connect M6E 5G Portable WiFi Router", "versions": [{"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "M6E_AI_1.00.000019"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.acer.com/en/kb/articles/19707"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.", "supportingMedia": [{"type": "text/html", "value": "The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "shortName": "Acer", "dateUpdated": "2026-06-04T05:43:55.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49192", "state": "PUBLISHED", "dateUpdated": "2026-06-04T12:35:37.028Z", "dateReserved": "2026-05-28T02:46:15.561Z", "assignerOrgId": "8fc372e3-d9c5-46e4-9410-38469745c639", "datePublished": "2026-06-04T05:43:55.875Z", "assignerShortName": "Acer"}, "dataVersion": "5.2"}