cbcvebase.
CVE-2026-49200
published 2026-05-29

CVE-2026-49200: The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for…

PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.52%
40.1th percentile
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

Affected

2 ranges
VendorProductVersion rangeFixed in
acerwave_7_firmware<= t7c_gbl_1.01.000055
acerwave_7_routerT7c_GBL_1.01.000055 – *

Detection & IOCsextracted from sources · hover to see the quote

pathacer_cgi.log
urlhttp://192.168.76.1
domainacerconnect.com
  • Monitor unauthenticated HTTP GET requests to the acer_cgi.log file path on the router web interface, which would indicate exploitation of the broken access control vulnerability.
  • Alert on Telnet login attempts using credentials that may have been harvested from the exposed acer_cgi.log file, particularly from external/untrusted IP addresses.
  • ·Both CVEs are rated maximum severity and are unpatched zero-days; remote management should be disabled or restricted to trusted IPs as an interim mitigation.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.