## Summary
CVE-2026-49193 describes overly permissive configuration settings on cloud storage containers that expose active telemetry information publicly to the internet. The affected component is acer connect m6e 5g firmware versions <= m6e_ai_1.00.000019.
## Technical Details
- The issue is attributed to misconfigured cloud storage container permissions that allow public access to telemetry data.
- The NVD description indicates the exposed information is active telemetry, meaning it can reflect ongoing device/system state.
- The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N implies:
- Network-based access (AV:N)
- No privileges required (PR:N)
- No user interaction required (UI:N)
- High confidentiality impact (C:H)
## Affected
- acer connect m6e 5g firmware <= m6e_ai_1.00.000019
## Impact
- Confidentiality breach: active telemetry information becomes publicly accessible over the internet.
- Integrity and availability are not indicated as impacted (I:N, A:N).
## Mitigation
1. Restrict cloud storage container access to authenticated/authorized principals only (remove public/anonymous read permissions).
2. Review and tighten container-level policies and any related IAM settings to ensure least-privilege access.
3. Validate externally reachable endpoints/containers are not publicly listing or serving telemetry data.
4. Update acer connect m6e 5g firmware to a version that addresses the permissive configuration (exact fixed version not provided in the available data).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200