Which versions of Acer Wave 7 Router are affected by CVE-2026-49200?

Acer Wave 7 routers expose administrative credentials in cleartext to any network-connected attacker without authentication, enabling complete device takeover.

How to fix or mitigate CVE-2026-49200?

Within 24 hours: Identify all Acer Wave 7 routers running firmware T7c_GBL_1.01.000055 or earlier; restrict web interface access to trusted administrative networks only via firewall rules. Within 7 days: Reset all router administrative credentials; review device access logs for indicators of compromise; scan network for unauthorized device modifications. Within 30 days: Implement network segmentation to isolate router management traffic; deploy continuous monitoring for vendor patch announcements; develop device replacement schedule pending patch availability.

Acer Wave 7 Router CVE-2026-49200

Q: What is the CVSS score of CVE-2026-49200?

CVE-2026-49200 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33270 CRITICAL

Insertion of Sensitive Information into Log File (CWE-532)

2026-05-29 Acer

GHSA-xf88-3pmx-m4vw

Authentication Bypass Wave 7 Router Acer

10.0

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 11:20 vuln.today

CVSS changed

May 29, 2026 - 09:22 NVD

10.0 (CRITICAL)

CVE Published

May 29, 2026 - 08:51 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

AnalysisAI

Credential disclosure in the Acer Wave 7 router (firmware T7c_GBL_1.01.000055 and earlier) exposes the acer_cgi.log file over the web interface without authentication, leaking cleartext web and Telnet login credentials to any network-reachable attacker. With CVSS 4.0 of 10.0 and a vector indicating no privileges or user interaction, exploitation enables full device takeover; no public exploit identified at time of analysis, but the trivial nature of fetching a log file makes weaponization straightforward.

Technical ContextAI

The Acer Wave 7 is a consumer/SOHO wireless router whose embedded web management interface serves a diagnostic/log file named acer_cgi.log without enforcing session authentication or access controls. The root cause maps to CWE-532 (Insertion of Sensitive Information into Log File), compounded by missing authorization on the file-serving endpoint: administrative credentials for both the HTTP management UI and the Telnet management service are written to this log in cleartext, then retrievable via an unauthenticated HTTP GET. Per the CPE (cpe:2.3:a:acer:wave_7_router) this is firmware-resident behavior, meaning the vulnerable code path is reachable on any device exposing the web UI, including LAN-side defaults.

RemediationAI

Patch status from the provided data indicates the vulnerability was reported by Acer with an advisory at https://community.acer.com/en/kb/articles/19673, but no specific fixed firmware build is included in the input data - administrators should consult the Acer KB article for the vendor-released patched firmware and upgrade Wave 7 routers above T7c_GBL_1.01.000055. As compensating controls until firmware is applied, disable the WAN/remote-management interface so the web UI is not internet-reachable (trade-off: loss of remote administration), restrict the LAN-side management interface to a dedicated management VLAN or specific admin source IPs via the router's ACLs (trade-off: requires re-architecting client access), disable the Telnet service entirely since its credentials are part of the disclosure (trade-off: breaks any Telnet-based monitoring or scripts), and rotate the web and Telnet administrative passwords immediately after patching given they should be assumed compromised on any reachable device.