NewsPublished 3 Jun 2026

Acer working to patch max severity zero-days in Wave 7 routers

Source Bleeping Computer

Mentions 2 CVEs

Mentioned vulnerabilities

Description

Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. [...]

Impact

Successful exploitation of CVE-2026-49200 can lead to unauthorized system access by exposing plaintext credentials, potentially allowing attackers to control the router. CVE-2026-49201 enables attackers to maintain persistent backdoor access by decrypting and modifying system backups, which could compromise the integrity and security of the device. These vulnerabilities pose significant risks to device confidentiality, integrity, and availability. No evidence of active exploitation has been reported so far.

Defensive guidance

Acer is actively developing official firmware updates to fix these vulnerabilities, with a planned release by the end of June 2026. Users should apply these updates immediately once available. Until patches are released, Acer strongly recommends disabling remote management features or restricting remote access to trusted IP addresses to reduce exposure. Following these vendor-provided mitigation steps is critical to minimizing risk.

References

bleepingcomputer.com/news/security/acer-warns-of-max-severity-zero-days-affecting-wave-7-routers/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Jun 2026, 11:48 UTC

References

Community reviews

Related threats