CVE-2026-49201Disclosure(acer / wave_7)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch acer wave_7 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

acer CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://community.acer.com/en/kb/articles/19673

Weakness type (CWE)

CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wave_7
wave_7_firmware

Threat summary

Patch or workaround signal is available
6 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 5d ago at 1 mentions (2026-05-29); latest day: 1
6 total mentions across 6 days

Affected systems

Vendors

acer

Products

wave_7wave_7_firmware

1 version affected across 2 products

Deep dive

Activity timeline6 mentions / 6d

Signal classification2 categories

Disclosure

583.3%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-29	1	Disclosure1
2026-05-31	1	Disclosure1
2026-06-01	1	Disclosure1
2026-06-04	1	Patch1
2026-06-05	1	Disclosure1
2026-06-08	1	Disclosure1

Full discourse6 posts

CCB Alert@CCBalert134d
Disclosure
Warning: Multiple critical vulnerabilities in #Acer Wave 7 Router and Connect app. Beware especially of CVE-2026-49201 (CVSS:10) that can be exploited to target system backups and facilitate persistent backdoor injection. #Patch #Patch #Patch
Post summary
The message announces newly disclosed critical vulnerabilities in Acer Wave 7 Router, highlighting CVE-2026-49201 with a CVSS score of 10 and its potential for backup exploitation and backdoor insertion, and urges users to apply patches.
01000207
7.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-49201 Hardcoded AES Encryption Key in upload.cgi Enables Backup Manipul... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49201 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE-2026-49201, describing a hardcoded AES key vulnerability in upload.cgi that could enable backup manipulation.
0000145
4.0K followersView on X
DailyCVE@dailycve127d
Disclosure
🔴 Acer Wave 7, Hardcoded #Crypto Key, #CVE-2026-49201 (Critical) -DC-Jun2026-260 https://dailycve.com/acer-wave-7-hardcoded-crypto-key-cve-2026-49201-critical-dc-jun2026-260/
Post summary
A new, critical CVE (2026-49201) against Acer Wave 7 is announced, noting a hardcoded crypto key vulnerability; no evidence of exploitation or mitigation steps is provided.
0000043
210 followersView on X
セキュリティ対策Lab@securityLab_jp130d
Disclosure
AcerのWave 7ルーターに2件のゼロデイ脆弱性-(CVE-2026-49200,CVE-2026-49201) https://rocket-boys.co.jp/security-measures-lab/acer-wave-7-flaws-cve-2026-49200-cve-2026-49201/ #セキュリティ対策Lab #security #securitynews #cyberattack #incident #databreach
Post summary
The post announces the discovery of two zero‑day vulnerabilities (CVE‑2026‑49200, CVE‑2026‑49201) in Acer Wave 7 routers, with no details on exploitation, patches, or technical specifics.
00000103
419 followersView on X
ThreatCluster@threatcluster131d
Patch
Acer confirmed it is working to address two max-severity zero-day flaws in Wave 7 mesh routers, CVE-2026-49200 and CVE-2026-49201, that allow unauthenticated credential theft and backdoor access, BleepingComputer reported. https://threatcluster.io/cluster/acer-addresses-critical-zero-day-vulnerabilities-in-wave-7-r-a187beb6
Post summary
Acer acknowledges two critical zero‑day flaws in Wave 7 mesh routers and is working on a patch, with no evidence of active exploitation or a PoC.
0000064
289 followersView on X
SecAlerts@SecAlertsCo135d
Disclosure
CVE-2026-49201: Acer Wave 7 router has a hardcoded AES key in upload.cgi. Anyone can decrypt, tamper, and re-encrypt your backups. CVSS 10 critical, no auth required. If this router is in your stack, act now. https://secalerts.co/vulnerability/CVE-2026-49201 https://t.co/Bagi9ApAYL
Post summary
The tweet announces a newly disclosed critical vulnerability in Acer Wave 7 routers, detailing that a hardcoded AES key in upload.cgi allows unauthenticated decryption and tampering of backup files.
0000088
825 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	acer	wave_7	-	-	-
OS	acer	wave_7_firmware	-	-	-

Explore more

Back to dashboard acer CVEs wave_7 vulnerabilities

What researchers are saying

CVE-2026-49201

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

The post announces the discovery of two zero‑day vulnerabilities (CVE‑2026‑49200, CVE‑2026‑49201) in Acer Wave 7 routers, with no details on exploitation, patches, or technical specifics.

ThreatCluster[verified]@threatclusterPatch

Acer acknowledges two critical zero‑day flaws in Wave 7 mesh routers and is working on a patch, with no evidence of active exploitation or a PoC.

CCB Alert@CCBalertDisclosure

The message announces newly disclosed critical vulnerabilities in Acer Wave 7 Router, highlighting CVE-2026-49201 with a CVSS score of 10 and its potential for backup exploitation and backdoor insertion, and urges users to apply patches.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2026-49201, describing a hardcoded AES key vulnerability in upload.cgi that could enable backup manipulation.

DailyCVE@dailycveDisclosure

A new, critical CVE (2026-49201) against Acer Wave 7 is announced, noting a hardcoded crypto key vulnerability; no evidence of exploitation or mitigation steps is provided.

SecAlerts@SecAlertsCoDisclosure

The tweet announces a newly disclosed critical vulnerability in Acer Wave 7 routers, detailing that a hardcoded AES key in upload.cgi allows unauthenticated decryption and tampering of backup files.