CVE-2026-49200: Acer Wave 7 router: Broken Access Control

Overview

The Acer Wave 7 router firmware makes a file named acer_cgi.log reachable through the web interface without authentication. The record states that this file contains cleartext login credentials for the web and Telnet services, which can lead to unauthorized system access. The weakness is classified as CWE-532, insertion of sensitive information into a log file, while the title frames the issue as broken access control.

Impact

• Exposure of cleartext credentials for web and Telnet access, as described in the record.
• Potential unauthorized access to the device, which the record associates with the exposed credentials.
• The NVD base score is 9.8 (critical), and the NVD vector marks confidentiality, integrity and availability impact as high.
• The record does not describe the consequences beyond unauthorized system access.

Affected products and versions

The record lists two product entries. The Acer Wave 7 Firmware entry covers versions up to and including 01.000055. The Acer Wave 7 router entry covers versions from 01.000055 onward. Both entries share the same boundary build, which reads as contradictory, so this is an inference that the exact affected range must be confirmed with the vendor advisory.

Exploitation status

The record shows that this vulnerability is not listed in CISA KEV and that the SSVC exploitation value is none. No confirmed exploitation appears in the sources consulted. The record marks the issue as automatable, which is a prioritization signal and not evidence of attacks. The EPSS probability is 0.00615 with a percentile of 0.48822, as dated in the record.

Remediation and mitigation

• Consult the Acer vendor advisory and apply the firmware update it recommends for your model.
• The record contains no fixed version. This does not mean no fix exists, so verify the status with the vendor.
• Restrict access to the device web and Telnet interfaces to trusted administrative networks only.
• Change any credentials that may have been stored or exposed on affected devices, and disable Telnet if it is not required.

Detection guidance

• Review device and network logs for unexpected access to the web interface from untrusted sources.
• Monitor for unexpected Telnet sessions to the device.
• Inventory Acer Wave 7 devices and record their firmware builds to identify those in the affected range.

Limitations of the available information

• The record does not give a fixed version, and the affected version boundaries overlap and need vendor confirmation.
• The record does not describe the exact access path, authentication details or the full scope of exposure.
• The CWE is information exposure through logs, while the title says broken access control; the record does not explain this difference.
• The EPSS date in the record is later than the publication date, so the timing of the EPSS value should be treated with caution.

Frequently asked questions

What is the main risk of CVE-2026-49200?

According to the record, the acer_cgi.log file can be read without authentication and contains cleartext web and Telnet credentials, which can lead to unauthorized system access.

Is this vulnerability being exploited in the wild?

The record shows it is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists versions up to and including 01.000055 for the firmware and from 01.000055 onward for the router. These overlapping boundaries should be confirmed with the vendor advisory.

What should administrators do now?

Check the Acer advisory, apply the vendor recommended update, restrict web and Telnet access to trusted networks and change any exposed credentials.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.