Two critical zero-day vulnerabilities affect Acer Wave 7 mesh routers with firmware T7c_GBL_1.01.000055 or earlier. CVE-2026-49200 is a broken access control flaw exposing the acer_cgi.log file without authentication, leaking cleartext login credentials for web and Telnet access. CVE-2026-49201 is due to a hardcoded AES key in the upload.cgi binary, allowing attackers to manipulate device backups to inject persistent backdoors. Acer has confirmed these issues and is developing firmware updates scheduled for release by the end of June 2026. Until then, mitigation involves disabling remote management or limiting remote access to trusted IPs.

Successful exploitation of CVE-2026-49200 can lead to unauthorized system access by exposing plaintext credentials, potentially allowing attackers to control the router. CVE-2026-49201 enables attackers to maintain persistent backdoor access by decrypting and modifying system backups, which could compromise the integrity and security of the device. These vulnerabilities pose significant risks to device confidentiality, integrity, and availability. No evidence of active exploitation has been reported so far.

Acer is actively developing official firmware updates to fix these vulnerabilities, with a planned release by the end of June 2026. Users should apply these updates immediately once available. Until patches are released, Acer strongly recommends disabling remote management features or restricting remote access to trusted IP addresses to reduce exposure. Following these vendor-provided mitigation steps is critical to minimizing risk.