Aller au contenu
Se connecter
10.0 Critique

CVE-2026-49201 The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key

Description

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

Produits et versions touchés

Produit Versions touchées Corrigé en
Wave 7 router Versions non publiées

Autres CVE de Wave 7 router

Les 2 CVE de Wave 7 router →
CVE-2026-49200 The acer_cgi.log file in the device firmware is accessible without authentication via the web interface 10.0 Critique
Suivre cette CVE