The Acer Wave 7 router firmware version T7c_GBL_1.01.000055 contains a vulnerability (CVE-2026-49200) where the acer_cgi.log file is publicly accessible without authentication through the web interface. This log file includes cleartext login credentials for web and Telnet services, enabling attackers to obtain these credentials and achieve unauthorized access to the device. The vulnerability is classified under CWE-532 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 4.0 vector indicates network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No patch or official remediation has been documented.

An attacker can access the acer_cgi.log file without authentication and retrieve cleartext login credentials for both web and Telnet interfaces. This leads to unauthorized system access, potentially allowing full control over the affected router. The impact is critical given the ease of exploitation and the sensitive nature of the exposed information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the router's web interface from untrusted networks and disable Telnet access if possible. Monitor for vendor updates and apply patches promptly once available.