# Acer Wave 7 Mesh Routers — Max-Severity Unauthenticated Zero-Days CVE-2026-49200 (Cleartext Credential Disclosure) & CVE-2026-49201 (Hardcoded AES Key Backdoor)

> Acer disclosed two CVSS 4.0 10.0 zero-day vulnerabilities in its Wave 7 Wi-Fi 7 mesh routers (firmware T7c_GBL_1.01.000055 and earlier), reported by researcher Gergo Pap. CVE-2026-49200 (CWE-532) exposes the acer_cgi.log file without authentication via the web interface, leaking cleartext web and Telnet credentials. CVE-2026-49201 (CWE-798) is a hardcoded AES key in the upload.cgi backup-processing binary that lets an unauthenticated remote attacker decrypt, modify, and re-encrypt system backups to inject a persistent firmware-level backdoor. No patch exists as of disclosure; Acer targets a firmware fix by end of June 2026.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0674
- **ID:** TL-2026-0674
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-49200, CVE-2026-49201

## Description

Acer confirmed two maximum-severity (CVSS 4.0 base 10.0) zero-day vulnerabilities affecting Wave 7 Wi-Fi 7 mesh routers running firmware build T7c_GBL_1.01.000055 or earlier. Both flaws are network-reachable, require no authentication and no user interaction, and were privately reported to Acer by independent security researcher Gergo Pap. Acer published the advisory and assigned both CVEs as the issuing CNA on 2026-05-29; public reporting followed on 2026-06-03. No security patch was available at disclosure, leaving an open exposure window until Acer's targeted firmware fix at the end of June 2026.

CVE-2026-49200 — Broken Access Control / Sensitive Information in Log File (CWE-532). The device firmware writes an operational log, acer_cgi.log, that is retrievable through the router web interface with no authentication. The file contains cleartext login credentials for both the web management interface and the Telnet service. An unauthenticated remote attacker who can reach the management interface simply requests the log file and harvests valid administrator credentials, yielding full unauthorized system access. Because the credentials are valid accounts, subsequent logins to the web UI and Telnet are indistinguishable from legitimate administration absent network-layer monitoring.

CVE-2026-49201 — Use of Hard-coded Cryptographic Key (CWE-798). The upload.cgi binary responsible for processing device configuration/system backups embeds a static, hardcoded AES encryption key. Because the same key protects every device's backups, an unauthenticated attacker can decrypt an intercepted or attacker-generated backup blob, modify its contents (e.g., inject startup scripts, enable services, or alter credentials), re-encrypt it with the known key so the integrity/authenticity check passes, and have the router accept it. This converts the backup-restore path into a persistent, firmware-level backdoor injection primitive that survives reboots and, potentially, factory-reset workflows that re-apply a saved configuration.

Exploit chain. The two flaws compose into a complete unauthenticated compromise: (1) Initial Access — retrieve acer_cgi.log over HTTP to obtain cleartext admin/Telnet credentials (CVE-2026-49200), or directly weaponize the backup path; (2) Credential Access — parse cleartext web and Telnet credentials from the log; (3) Persistence — craft a malicious backup, encrypt it with the hardcoded AES key (CVE-2026-49201), and restore it via upload.cgi to implant a durable backdoor; (4) Lateral Movement / C2 — reuse harvested credentials over Telnet or the web UI, and pivot from the compromised edge device into the internal network the router fronts. A perimeter mesh router is a high-value foothold: it terminates the WAN, sees all internal traffic, and is trusted by downstream clients.

Exploitation status. As of 2026-06-03 there is no confirmed in-the-wild exploitation and no public packaged proof-of-concept; however, the exploitation mechanics for CVE-2026-49200 are fully described in the vendor advisory and reduce to an unauthenticated file fetch, making practical exploitation trivial once the management interface is reachable. There are no network/C2 indicators of compromise associated with this disclosure (no observed adversary infrastructure), so no BeaconBeagle C2 correlation applies; the actionable IOCs are device-local artifacts (acer_cgi.log, upload.cgi) and behavioral signatures (unauthenticated access to the log path, anomalous backup uploads).

Mitigation. Until firmware is released, disable remote (Internet-side) management of the router and, where the firmware permits, restrict remote administration to a trusted IP allowlist. Treat any Wave 7 already exposed to the Internet as potentially compromised: rotate web and Telnet credentials, disable Telnet, and audit the running configuration/backups for unauthorized changes once patched. Apply the Acer firmware update immediately on release via System Management > Firmware Update.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1552 Unsecured Credentials
- T1600 Weaken Encryption
- T1078 Valid Accounts
- T1601 Modify System Image
- T1021 Remote Services
- T1005 Data from Local System
- T1565 Data Manipulation

## Sources

- [Acer working to patch max severity zero-days in Wave 7 routers](https://www.bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/)
- [Acer Security Advisory: Upcoming Firmware Update for Acer Wave 7 Router (KB 19673)](https://community.acer.com/en/kb/articles/19673)
- [CVE-2026-49200 — Vulnerability-Lookup (CIRCL)](https://vulnerability.circl.lu/vuln/cve-2026-49200)
- [CVE-2026-49201 — Vulnerability-Lookup (CIRCL)](https://vulnerability.circl.lu/vuln/cve-2026-49201)
- [NVD — CVE-2026-49200](https://nvd.nist.gov/vuln/detail/CVE-2026-49200)
- [NVD — CVE-2026-49201](https://nvd.nist.gov/vuln/detail/CVE-2026-49201)
- [Acer Wave 7 Wi-Fi 7 Mesh Router — Product Support](https://www.acer.com/us-en/support/product-support/Acer_Wave_7_Wi-Fi_Mesh_Router)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0674