CVE-2026-50208
TrustAllCerts TLS Certificate Validation Bypass with DES Key Exposure
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: 8fc372e3-d9c5-46e4-9410-38469745c639
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| acer | connect_m6e | to 1.00.000019 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-330 | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves high-risk TrustAllCerts routines that disable the standard TLS certificate validation process.
Additionally, the use of hard-coded DES symmetric encryption keys further weakens security.
Together, these issues allow a Man-in-the-Middle (MITM) attacker to potentially decrypt network traffic.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could intercept and decrypt sensitive network communications.
This could lead to exposure of confidential information, unauthorized data access, and compromise of data integrity.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves disabling standard TLS certificate validation and using hard-coded DES encryption keys, which could allow a Man-in-the-Middle (MITM) attacker to decrypt network traffic. Such weaknesses in protecting data in transit can lead to unauthorized access to sensitive information.
Because of the potential exposure of sensitive data through intercepted communications, this vulnerability could negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require strong safeguards for personal and health information during transmission.
Organizations using affected devices should consider this vulnerability a significant risk to maintaining confidentiality and integrity of data, and should apply patches and mitigation measures promptly to uphold compliance obligations.
What immediate steps should I take to mitigate this vulnerability?
Users are advised to secure their devices with strong administrative passwords and restrict IPv6 traffic where possible.
It is important to apply the forthcoming firmware patches via the device management interface as soon as they are released.