Acer Wave 7 Router vulnerabilities

CVE-2026-49200 [CRITICAL] CWE-532 CVE-2026-49200: The acer_cgi.log file in the device firmware is accessible without authentication via the web interf The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

CVE-2026-49201 [CRITICAL] CWE-798 CVE-2026-49201: The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryptio The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.