CVE-2026-49200: Acer Wave 7 router: Broken Access Control

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove Acer Wave 7: /acer_cgi.log from your environment.

   Remove the acer_cgi.log file from device firmware and ensure device does not store cleartext login credentials in accessible log files.

2. Configuration

   Require authentication for access to acer_cgi.log and any diagnostic or log files via the web interface; enforce proper access controls for management pages.

   Acer Wave 7 web interface acer_cgi.log file access = authenticated-only
3. Configuration

   Disable Telnet access on the device if it is not required; if remote management is needed use a secure, authenticated management channel.

   Telnet service enabled = false
4. Compensating control

   Restrict access to the device management interface (HTTP/HTTPS/Telnet) to trusted IPs or networks via firewall, ACLs, or network segmentation to reduce exposure of sensitive log files.

5. Operational

   Rotate all credentials found in acer_cgi.log (web and Telnet accounts), reset affected accounts, and change passwords for any accounts that may have been exposed.

6. Operational

   Investigate for signs of unauthorized access on affected devices, reimage or restore from known-good firmware if compromise is suspected, and review logs for suspicious activity. Monitor vendor advisories and apply vendor-supplied firmware updates when they become available.

Event History

Frequently Asked Questions