Acer Plans Fixes for Two Maximum-Severity Zero-Days in Wave 7 Routers
Summary
Acer says two zero-days affect Wave 7 routers running firmware T7c_GBL_1.01.000055 or earlier. They can expose plaintext credentials or enable persistent backdoor access. Fixes are planned by the end of June 2026; Acer advises disabling remote management meanwhile.
Key points
- CVE-2026-49200 allows unauthenticated remote access to log archives containing plaintext web and Telnet credentials.
- CVE-2026-49201 involves a hardcoded AES key in upload.cgi that can enable attackers to modify backups and inject a persistent backdoor.
- The vulnerabilities affect Wave 7 routers running firmware T7c_GBL_1.01.000055 or earlier.
- Acer says firmware fixes are planned by the end of June 2026; no patches are available yet.
- Until updates are available, Acer advises disabling remote management or restricting internet access to trusted IP addresses.
Article Details
- Vulnerability Types
- Broken access control
- Hardcoded cryptographic key
- Severity
- Maximum severity
- Affected Versions
- Acer Wave 7 firmware T7c_GBL_1.01.000055 or earlier
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Disable remote management until a patch is available.
- If supported by the firmware, restrict Internet remote access to trusted IP addresses.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe flaws allow remote attackers to exploit vulnerabilities affecting the Wave 7 router's web interface and backup-processing functionality.T1552.001 · Credentials In FilesCVE-2026-49200 exposes cleartext web and Telnet credentials stored in the acer_cgi.log file.T1565.001 · Stored Data ManipulationCVE-2026-49201 allows system backups to be decrypted, modified to inject a persistent backdoor, and re-encrypted.
CVE
CVE-2026-49200The flaws, tracked as CVE-2026-49200 and CVE-2026-49201, affect firmware version T7c_GBL_1.01.000055 or earlier, with fixes planned by the end of June 2026.CVE-2026-49201The flaws, tracked as CVE-2026-49200 and CVE-2026-49201, affect firmware version T7c_GBL_1.01.000055 or earlier, with fixes planned by the end of June 2026.