Acer Wave 7 Router vulnerabilities

2 vulnerabilities

Known vulnerabilities in Acer Wave 7 Router, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

10CVE-2026-49201acerwave_7_firmware+1
EPSS score
0.31%
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.10CVE-2026-49200acerwave_7_firmware+1
EPSS score
0.61%
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.