Wave 7 router vulnerabilities

2 known vulnerabilities in Wave 7 router from Acer. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Wave 7 router: Use of Hard-coded Credentials

  CVE-2026-49201May 29, 2026Acer

  The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

• 9.8 Critical severity

  Wave 7 router: Insertion of Sensitive Information into Log File

  CVE-2026-49200May 29, 2026Acer

  The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.