Acer Routers Await Patches for Maximum-Severity Flaws
NEOSEC enrichment — no mirror of the original source
Acer has published a security advisory noting that fixes will be released by the end of June 2026 for two CVSS 10.0 vulnerabilities in the firmware on Acer Wave 7 routers. CVE-2026-49200 allows an attacker to gain unauthorized system access
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
- CVE-2026-49201The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re…
- CVE-2026-49201acer wave_7_firmware: hartcodierte Zugangsdaten
- CVE-2026-49200Acer Wave 7 router: vertrauliche Informationen in Protokolldateien
- CVE-2026-49200The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for …
Affected vendors and products
More on Maximum-Severity
Other news entries
- Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command BackdoorsNewsThe Hacker News
- Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet CredentialsNewsThe Hacker News
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacksNewsBleepingComputer
- CISA says max severity GitLab flaw now exploited in the wildNewsBleepingComputer
- HPE patches eight max severity RCE and auth bypass AOS flawsNewsBleepingComputer
- GitLab warns of new max severity code execution vulnerabilityNewsBleepingComputer
- Critical BlockStrap flaw lets hackers run code on Magento serversNewsBleepingComputer
- SAP warns of maximum severity OAuth2 SSRF security flawNewsBleepingComputer
Source: https://community.acer.com/
ID