CVE-2026-50224: Unauthenticated IPv6 WAN Management Exposure
The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reconfigure the web administration panel so it does not listen on [::]:8080. Change its bind/listen address to loopback or to a specific internal-only interface to prevent exposure to the IPv6 WAN.
web administration panel bind_address/listen_address = do not bind to [::]; bind only to internal interfaces or loopback (::1) or a specific internal IPv6 address - Configuration
If remote IPv6 administration is not required, disable IPv6 WAN management to remove administrative access over the public IPv6 network.
web administration panel IPv6 WAN management = disabled - Configuration
Enable and require authentication for the web administration panel and any internal API endpoints so unauthenticated access is not permitted.
web administration panel authentication = enabled - Compensating control
Apply firewall rules to block or restrict IPv6 access to TCP port 8080 from the WAN; allow only trusted IP addresses or internal networks to reach the administration/API port.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50224?
CVE-2026-50224 has a medium severity rating of 6.9 according to the CVSS scoring system.
How do I fix CVE-2026-50224?
To fix CVE-2026-50224, restrict access to the web administration panel by implementing a firewall to block external access to port 8080.
What are the risks associated with CVE-2026-50224?
The risks include unauthorized access to internal API endpoints due to the web administration panel being exposed to the public IPv6 address space.
Which software is affected by CVE-2026-50224?
CVE-2026-50224 affects the Acer Connect M6e 5g Firmware.
When was CVE-2026-50224 published?
CVE-2026-50224 was published on June 4, 2026.