Vulnerability · Published May 29, 2026 · Assigned by Acer
CVE-2026-49200Acer Wave 7 router: Broken Access Control
Critical 10.0
In plain English
A critical-severity sensitive data in logs in Wave 7 router from Acer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acer | Wave 7 router | T7c_GBL_1.01.000055 – through * |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H