CVE-2026-50213

<= m6e_ai_1.00.000019

The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterat

7.5HIGH

CVE-2026-50212

<= m6e_ai_1.00.000019

Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints

6.5MEDIUM

CVE-2026-50211

<= m6e_ai_1.00.000019

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps writ

9.8CRITICAL

CVE-2026-50210

<= m6e_ai_1.00.000019

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attac

7.5HIGH

CVE-2026-50209

<= m6e_ai_1.00.000019

Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shiftin

7.8HIGH

CVE-2026-50208

<= m6e_ai_1.00.000019

High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption

9.4CRITICAL

CVE-2026-50207

<= m6e_ai_1.00.000019

The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files

7.8HIGH

CVE-2026-50206

<= m6e_ai_1.00.000019

Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config f

6.8MEDIUM

CVE-2026-50205

<= m6e_ai_1.00.000019

System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification dat

8.2HIGH

CVE-2026-49204

<= m6e_ai_1.00.000019

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.

6.5MEDIUM

CVE-2026-49203

<= m6e_ai_1.00.000019

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be

8.3HIGH

CVE-2026-49202

<= m6e_ai_1.00.000019

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CO

8.6HIGH

CVE-2026-49194

<= m6e_ai_1.00.000019

The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly ent

8.8HIGH

CVE-2026-49193

<= m6e_ai_1.00.000019

Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.

7.5HIGH

CVE-2026-49192

<= m6e_ai_1.00.000019

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers

5.4MEDIUM

CVE-2026-49191

<= m6e_ai_1.00.000019

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error han

9.8CRITICAL

CVE-2026-49190

<= m6e_ai_1.00.000019

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized a

8.8HIGH

CVE-2026-49189

<= m6e_ai_1.00.000019

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administra

7.8HIGH

CVE-2026-49188

<= m6e_ai_1.00.000019

The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthen

9.8CRITICAL

CVE-2026-49187

<= m6e_ai_1.00.000019

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

7.5HIGH

CVE-2026-49186

<= m6e_ai_1.00.000019

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard

9.8CRITICAL

CVE-2026-49185

<= m6e_ai_1.00.000019

The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injectio

9.8CRITICAL