Paper/Archive/CVE-2026-49200

CVE-2026-49200

Acer Wave 7 router — Acer Wave 7 router: Broken Access Control

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 44.1.441 × 208.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

Affected

ProductAffectedFixed inSource

Wave 7 routerT7c_GBL_1.01.000055 – *–CNA

Scores by source

Acer (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcommunity.acer.com/en/kb/articles/19673