CVE-2026-49201

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.26%
EPSS Percentile: 18.09%
CISA KEV: Not listed

Description

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 8fc372e3-d9c5-46e4-9410-38469745c639
Published: 29-May-2026 18:16
Last Modified: 21-Jul-2026 19:10
EPSS Date: 2026-10-31
CWE: CWE-798

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

acer / wave_7_firmware
Version / affected range: * · through (inclusive) t7c_gbl_1.01.000055
cpe:2.3:o:acer:wave_7_firmware:*:*:*:*:*:*:*:*

References

8fc372e3-d9c5-46e4-9410-38469745c639

Last enrichment sync: 01-Nov-2026 10:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The flaws, tracked as CVE-2026-49200 and CVE-2026-49201, affect firmware version T7c_GBL_1.01.000055 or earlier, with fixes planned by the end of June 2026. Acer Plans Fixes for Two Maximum-Severity Zero-Days in Wave 7 Routers

CVE (1)

People (1)

MITRE ATT&CK (3)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.