CVE-2026-50212: Arbitrary Remote Device Unbinding
Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce strict server-side validation in device unbind/dissociation endpoints: require authenticated requests, verify that the requesting principal owns the target device (ownership identifier match), validate session/access tokens, and deny any unbind request that fails these checks.
Device dissociation API authorization_and_owner_validation = strict server-side validation and authorization required - Configuration
Enable rate limiting, input validation, and anti-automation protections on the device dissociation API to limit the impact of mass/unexpected unbind attempts and ensure request parameters are well-formed before processing.
Device dissociation API rate_limiting_and_request_validation = enable rate limiting and input validation - Compensating control
Restrict access to the device dissociation API until fixes are deployed: apply network controls (firewall/ACL) to limit callers to trusted IP ranges, and deploy WAF rules to block anomalous or unauthorized unbind requests.
- Operational
Audit recent device unbind/dissociation logs for unauthorized activity, notify affected users, and restore or re-associate any inadvertently unbound endpoints. Rotate any credentials or tokens for devices or accounts suspected of compromise.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50212?
CVE-2026-50212 has a severity rating of high, with a CVSS score of 7.1.
How does CVE-2026-50212 affect users?
CVE-2026-50212 allows a remote entity to forcefully unbind unrelated user endpoints, resulting in a severe denial of service.
How do I fix CVE-2026-50212?
To mitigate CVE-2026-50212, update to the latest firmware version of Acer Connect M6e 5g and follow the security patches provided.
What software is impacted by CVE-2026-50212?
CVE-2026-50212 affects Acer Connect M6e 5g Firmware.
When was CVE-2026-50212 published?
CVE-2026-50212 was published on June 4, 2026.