CVE-2026-49200

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.52%
EPSS Percentile: 44.07%
CISA KEV: Not listed

Description

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 8fc372e3-d9c5-46e4-9410-38469745c639
Published: 29-May-2026 16:16
Last Modified: 21-Jul-2026 19:10
EPSS Date: 2026-10-31
CWE: CWE-532

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

acer / wave_7_firmware
Version / affected range: * · through (inclusive) t7c_gbl_1.01.000055
cpe:2.3:o:acer:wave_7_firmware:*:*:*:*:*:*:*:*

References

8fc372e3-d9c5-46e4-9410-38469745c639

Last enrichment sync: 01-Nov-2026 10:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The flaws, tracked as CVE-2026-49200 and CVE-2026-49201, affect firmware version T7c_GBL_1.01.000055 or earlier, with fixes planned by the end of June 2026. Acer Plans Fixes for Two Maximum-Severity Zero-Days in Wave 7 Routers

CVE (1)

People (1)

MITRE ATT&CK (3)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.