Skip to content
Sign in
10.0 Critical

CVE-2026-49200 The acer_cgi.log file in the device firmware is accessible without authentication via the web interface

Description

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

Affected products and versions

Product Affected versions Fixed in
Wave 7 router Versions not published

Other CVEs of Wave 7 router

The 2 CVEs of Wave 7 router →
CVE-2026-49201 The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key 10.0 Critical
Track this CVE