Which versions of Acer Wave 7 Router are affected by CVE-2026-49201?

Acer Wave 7 routers with firmware T7c_GBL_1.01.000055 and earlier contain a critical vulnerability allowing unauthenticated remote attackers to persistently compromise affected devices through…

How to fix or mitigate CVE-2026-49201?

24 hours: Inventory all Acer Wave 7 routers in production; identify devices running firmware T7c_GBL_1.01.000055 or earlier; disable remote management access if operationally feasible. 7 days: Implement network segmentation via dedicated VLANs for affected routers; restrict administrative credentials; enable enhanced logging on backup operations and upload.cgi access. 30 days: Monitor Acer security advisories for patch release timeline; establish firmware upgrade schedule upon patch availability; evaluate replacement routers for critical network segments.

Acer Wave 7 Router CVE-2026-49201

Q: What is the CVSS score of CVE-2026-49201?

CVE-2026-49201 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33271 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-29 Acer

GHSA-5xrr-7q3m-rh98

Authentication Bypass Wave 7 Router Acer

10.0

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:00 vuln.today

CVSS changed

May 29, 2026 - 11:22 NVD

10.0 (CRITICAL)

CVE Published

May 29, 2026 - 08:57 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

AnalysisAI

Hardcoded AES encryption key in the upload.cgi binary of the Acer Wave 7 router (firmware T7c_GBL_1.01.000055 and earlier) allows remote unauthenticated attackers to decrypt, tamper with, and re-encrypt device backup files, enabling persistent backdoor injection on affected devices. The CVSS 4.0 score of 10.0 reflects full compromise of confidentiality, integrity, and availability across both the vulnerable component and downstream subsequent systems. No public exploit identified at time of analysis, and CISA SSVC reports exploitation status as 'none', though the issue is flagged as automatable with total technical impact.

Technical ContextAI

The vulnerability resides in upload.cgi, a CGI binary responsible for handling the router's backup file workflow on the Acer Wave 7 (cpe:2.3:a:acer:wave_7_router). Per CWE-798 (Use of Hard-coded Credentials), the firmware embeds a static AES symmetric key inside the binary itself, meaning anyone who extracts the firmware (or reverse-engineers the CGI) recovers the same key used on every shipped device. Because backup archives are encrypted with that shared secret rather than a per-device or user-derived key, the cryptographic boundary that should protect the integrity of restored configuration is effectively void - an attacker can decrypt a captured or crafted backup, inject persistent malicious configuration or files, then re-encrypt and present it back to the device's restore routine as authentic.

RemediationAI

Patch status is not explicitly stated in the supplied data - no vendor-released fix version was provided alongside the advisory reference, so administrators should consult https://community.acer.com/en/kb/articles/19673 directly for the patched firmware build and apply it as soon as it is published. Until a vendor-released patch is independently confirmed, compensating controls include disabling remote/WAN-side administration on the router so the upload.cgi endpoint is not internet-reachable (trade-off: loss of remote management convenience), restricting LAN access to the admin web UI via firewall or VLAN segmentation to trusted management hosts only (trade-off: more complex setup for households with multiple admins), and avoiding the use of the backup/restore feature in environments where an attacker may have already obtained a backup file (trade-off: harder configuration recovery). Treat any existing backup files as potentially tampered with and do not restore from backups of unknown provenance.