Skip to content
Sign in
10.0 Critical

CVE-2026-49201 The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key

Description

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

Affected products and versions

Product Affected versions Fixed in
Wave 7 router Versions not published

Other CVEs of Wave 7 router

The 2 CVEs of Wave 7 router →
CVE-2026-49200 The acer_cgi.log file in the device firmware is accessible without authentication via the web interface 10.0 Critical
Track this CVE