CVE-2026-50210: Weak Static Cryptographic Initialization Vectors
The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace static zero-filled IVs by generating a fresh, cryptographically-random IV for every AES-CBC encryption operation; ensure IVs are not reused and are stored or transmitted with the ciphertext as required by the protocol.
Device encryption (AES-CBC) IV_generation = use a unique cryptographically-random IV per encryption (not all-zero/static) - Configuration
Migrate away from unauthenticated AES-CBC with static IVs by enabling an authenticated encryption mode (for example, an AEAD mode) or by applying a strong message authentication code (e.g., HMAC) to ciphertext to prevent replay and tampering.
Encryption configuration authenticated_encryption_or_mac = use AEAD or apply a strong MAC (e.g., HMAC) - Compensating control
Implement protocol- or application-level replay protections (nonces, sequence numbers, timestamps) and restrict access to interfaces that accept ciphertext (network ACLs, firewalls, or trusted-host restrictions) until the cryptographic fixes are deployed.
- Operational
Re-encrypt or migrate existing data that was encrypted using static zero IVs to the corrected scheme (fresh IVs and/or authenticated encryption), ensuring the new ciphertext and metadata are generated securely.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50210?
The severity of CVE-2026-50210 is classified as medium with a CVSS score of 6.9.
What risks are associated with CVE-2026-50210?
CVE-2026-50210 poses risks of replay attacks and known-plaintext decryption due to its use of static zero-filled Initialization Vectors.
How do I fix CVE-2026-50210?
To fix CVE-2026-50210, update the firmware of the Acer Connect M6e 5g device to a version that implements dynamic Initialization Vectors for AES-CBC.
What does CVE-2026-50210 refer to?
CVE-2026-50210 refers to a vulnerability concerning weak static cryptographic initialization vectors used in the Acer Connect M6e 5g firmware.
Who is affected by CVE-2026-50210?
Users of the Acer Connect M6e 5g device are affected by CVE-2026-50210.