Acer confirmed that it's working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. According to a Friday security advisory, the two security flaws were reported by security researcher Gergo Pap and affect Wave 7 routers running firmware version T7c_GBL_1.01.000055 or earlier. The first zero-day, a broken access control vulnerability tracked as CVE-2026-49200, can allow unauthenticated attackers to remotely access plaintext credentials stored in log archives. "The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access," Acer explained. The second one (CVE-2026-49201) stems from a hardcoded cryptographic key that lets remote attackers without privileges gain persistent backdoor access to the router. "The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key," the company added. "This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection." While no security patches are available yet for these two flaws, Acer says it's working on fixes that should be released by the end of the month. "The vulnerabilities mentioned above are scheduled to be resolved in upcoming firmware updates. The target fix is planned for deployment by the end of June 2026," it said. The company also "strongly enc...
Acer working to patch max severity zero-days in Wave 7 routers
BleepingComputer
·Sergiu Gatlan
·Published Jun 3, 2026
·Updated
Affected Software
1 affected component
Acer Wave 7 mesh router<=T7c_GBL_1.01.000055
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses Acer's efforts to address two maximum-severity zero-day vulnerabilities in its Wave 7 mesh routers.
2
What security implications are discussed in the article?
The article highlights the potential security risks associated with the zero-day vulnerabilities that could be exploited by attackers.
3
What products or software are affected by the vulnerabilities?
The vulnerabilities specifically affect Acer Wave 7 mesh routers running firmware version T7c_GBL_1.01.
4
Who reported the vulnerabilities mentioned in the article?
The vulnerabilities were reported by security researcher Gergo Pap.
5
What is Acer's response to the discovered vulnerabilities?
Acer confirmed that it is actively working on a patch to address the identified zero-day vulnerabilities.