PT-2026-44770 · Acer · Wave 7 Router

Gergo Pap · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-49200

Mitre

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The acer cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-49200

Affected Products

Wave 7 Router

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-49200 · Security Note
• https://community.acer.com/en/kb/articles/19673 · Note