CVE-2026-49200Disclosure(acer / wave_7)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch acer wave_7 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

acer CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://community.acer.com/en/kb/articles/19673

Weakness type (CWE)

CWE-532

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wave_7
wave_7_firmware

Threat summary

Patch or workaround signal is available
7 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 3d ago at 2 mentions (2026-06-04); latest day: 1
7 total mentions across 6 days

Affected systems

Vendors

acer

Products

wave_7wave_7_firmware

1 version affected across 2 products

Deep dive

Activity timeline7 mentions / 6d

Signal classification3 categories

Disclosure

457.1%

Patch

228.6%

General

114.3%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-30	1	Disclosure1
2026-05-31	1	Disclosure1
2026-06-04	2	Patch2
2026-06-05	1	Disclosure1
2026-06-08	1	Disclosure1
2026-06-10	1	General1

Full discourse7 posts

Stanislav Klevtsov@stansecure125d
General
Top #CVE to prioritize 👀 - @Android Framework #privesc (CVE-2025-48595) - @SolarWinds Serv-U (CVE-2026-28318) - @Cisco Catalyst SD-WAN Manager (CVE-2026-20245) - @Cisco Unified Communications Manager (CVE-2026-20230) - @Acer Wave 7 routers (CVE-2026-49200/49201) - @UniFi OS Server (CVE-2026-34908/34909) - @Google Chrome (CVE-2026-10881/10882/10883) - #MCP Toolbox (CVE-2026-9739) - @Ivanti ISTM (CVE-2026-9614) - @Atlassian Bamboo Data Center #RCE (CVE-2026-27727)
Post summary
The tweet lists several CVEs for prioritization but provides no detail on exploitation, patches, or technical aspects.
10000130
42 followersView on X
DailyCVE@dailycve127d
Disclosure
🔴 Acer Wave 7 Router, Broken Access Control (CWE-532) – #CVE-2026-49200 (Critical) -DC-Jun2026-250 https://dailycve.com/acer-wave-7-router-broken-access-control-cwe-532-cve-2026-49200-critical-dc-jun2026-250/
Post summary
The post announces a new critical vulnerability (CVE‑2026‑49200) in the Acer Wave 7 Router, noting broken access control but providing no PoC, exploit, or patch details.
0000041
210 followersView on X
セキュリティ対策Lab@securityLab_jp131d
Disclosure
AcerのWave 7ルーターに2件のゼロデイ脆弱性-(CVE-2026-49200,CVE-2026-49201) https://rocket-boys.co.jp/security-measures-lab/acer-wave-7-flaws-cve-2026-49200-cve-2026-49201/ #セキュリティ対策Lab #security #securitynews #cyberattack #incident #databreach
Post summary
Acer has disclosed two zero‑day vulnerabilities (CVE‑2026‑49200 and CVE‑2026‑49201) affecting its Wave 7 routers.
00000103
419 followersView on X
AFAA TECH@AFAATECH131d
Patch
🚨 ด่วน! Acer Wave 7 Router เจอ Zero-Day รุนแรงสุด (CVE-2026-49200) วิธีแก้ + อัปเดตเฟิร์มแวร์ก่อนโดนแฮก อ่านสรุปขั้นตอนชัด ๆ ที่นี่ 👇 อ่านเพิ่มเติม >>> https://blog.ttt-website.com/%e0%b8%a7%e0%b8%b4%e0%b8%98%e0%b8%b5%e0%b9%81%e0%b8%81%e0%b9%89%e0%b8%8a%e0%b9%88%e0%b8%ad%e0%b8%87%e0%b9%82%e0%b8%ab%e0%b8%a7%e0%b9%88-zero-day-%e0%b8%9a%e0%b8%99-acer-wave-7-routers-%e0%b8%ad #Acer #AcerWave7 #ZeroDay #AcerRouter #Cybersecurity #RouterPatch #CVE2026 #รับทำเว็บไซต์ #รับพัฒาระบบ #รับออกแบบเว็บไซต์
Post summary
The post announces a zero‑day vulnerability (CVE‑2026‑49200) in Acer Wave 7 routers and urges users to update firmware to apply the fix.
0000090
61 followersView on X
ThreatCluster@threatcluster131d
Patch
Acer confirmed it is working to address two max-severity zero-day flaws in Wave 7 mesh routers, CVE-2026-49200 and CVE-2026-49201, that allow unauthenticated credential theft and backdoor access, BleepingComputer reported. https://threatcluster.io/cluster/acer-addresses-critical-zero-day-vulnerabilities-in-wave-7-r-a187beb6
Post summary
Acer is addressing two zero‑day vulnerabilities in its Wave 7 routers that allow unauthenticated credential theft and backdoor access, with no evidence yet of active attacks or publicly shared exploit code.
0000064
289 followersView on X
SecAlerts@SecAlertsCo135d
Disclosure
CVE-2026-49200: Critical severity on the Acer Wave 7 router. No auth needed to read acer_cgi.log, which exposes cleartext web + Telnet credentials. Full system compromise, no friction. Check your network gear. #CriticalVuln #InfoSec https://secalerts.co/vulnerability/CVE-2026-49200 https://t.co/mrzKMnyxZi
Post summary
The tweet announces CVE-2026-49200, a critical vulnerability in the Acer Wave 7 router that allows unauthenticated log access, exposing credentials and enabling full system compromise, and urges users to check their network gear.
0000089
825 followersView on X
ADK Cyber@ADKCyber137d
Disclosure
CVE-2026-49200 (CVSS 10.0) affects Acer device firmware with unauthenticated access to credential data. If you use these devices, check vendor advisories and apply updates promptly. https://nvd.nist.gov/vuln/detail/CVE-2026-49200 Assess exposure at http://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning
Post summary
The post announces CVE-2026-49200, detailing its severity and impact, and advises users to follow vendor advisories and update firmware.
0000044
82 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	acer	wave_7	-	-	-
OS	acer	wave_7_firmware	-	-	-

Explore more

Back to dashboard acer CVEs wave_7 vulnerabilities

What researchers are saying

CVE-2026-49200

Stanislav Klevtsov[verified]@stansecureGeneral

The tweet lists several CVEs for prioritization but provides no detail on exploitation, patches, or technical aspects.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

Acer has disclosed two zero‑day vulnerabilities (CVE‑2026‑49200 and CVE‑2026‑49201) affecting its Wave 7 routers.

ThreatCluster[verified]@threatclusterPatch

Acer is addressing two zero‑day vulnerabilities in its Wave 7 routers that allow unauthenticated credential theft and backdoor access, with no evidence yet of active attacks or publicly shared exploit code.

ADK Cyber[verified]@ADKCyberDisclosure

The post announces CVE-2026-49200, detailing its severity and impact, and advises users to follow vendor advisories and update firmware.

DailyCVE@dailycveDisclosure

The post announces a new critical vulnerability (CVE‑2026‑49200) in the Acer Wave 7 Router, noting broken access control but providing no PoC, exploit, or patch details.

AFAA TECH@AFAATECHPatch

The post announces a zero‑day vulnerability (CVE‑2026‑49200) in Acer Wave 7 routers and urges users to update firmware to apply the fix.

SecAlerts@SecAlertsCoDisclosure

The tweet announces CVE-2026-49200, a critical vulnerability in the Acer Wave 7 router that allows unauthenticated log access, exposing credentials and enabling full system compromise, and urges users to check their network gear.