PT-2026-44770 · Acer · Device Firmware

Gergo Pap · CVE-2026-49200 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Acer Wave 7 router (affected versions not specified)

Description The acer cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials for both web and Telnet interfaces, which can lead to unauthorized system access and full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-49200

Affected Products

Device Firmware

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-49200 · Security Note
• https://community.acer.com/en/kb/articles/19673 · Vendor Advisory
• https://t.me/CVEtracker/55238 · Telegram Post
• https://twitter.com/stansecure/status/2064674395126157585 · Twitter Post
• https://twitter.com/threatcluster/status/2062451935152664733 · Twitter Post
• https://twitter.com/dailycve/status/2063973689440256297 · Twitter Post
• https://t.me/cveNotify/208736 · Telegram Post
• https://t.me/true_secator/8277 · Telegram Post
• https://twitter.com/ADKCyber/status/2060512605001892216 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2060988248667701738 · Twitter Post