CVE-2026-49201

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.acer.com/en/kb/articles/19673	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:acer:wave_7_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:acer:wave_7:-:*:*:*:*:*:*:*

History

21 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) El binario upload.cgi, responsable de procesar las copias de seguridad del dispositivo, contiene una clave de cifrado AES codificada de forma rígida. Esto permite a un atacante descifrar, modificar y volver a cifrar las copias de seguridad del sistema, facilitando la inyección persistente de puertas traseras.

08 Jun 2026, 12:34

Type	Values Removed	Values Added
CPE		cpe:2.3:o:acer:wave_7_firmware:::::::: cpe:2.3:h:acer:wave_7:-:::::::*
References	~~() https://community.acer.com/en/kb/articles/19673 -~~	() https://community.acer.com/en/kb/articles/19673 - Vendor Advisory
First Time		Acer wave 7 Acer wave 7 Firmware Acer
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

29 May 2026, 11:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 11:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-49201

Mitre link : CVE-2026-49201

CVE.ORG link : CVE-2026-49201

JSON object : View

Products Affected

acer

wave_7_firmware
wave_7

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-49201", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49201", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T10:52:54.691352Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "8fc372e3-d9c5-46e4-9410-38469745c639", "affectedData": [{"vendor": "Acer", "product": "Wave 7 router", "versions": [{"status": "affected", "version": "T7c_GBL_1.01.000055", "versionType": "custom", "lessThanOrEqual": "*"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T11:16:17.183", "references": [{"url": "https://community.acer.com/en/kb/articles/19673", "tags": ["Vendor Advisory"], "source": "8fc372e3-d9c5-46e4-9410-38469745c639"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "8fc372e3-d9c5-46e4-9410-38469745c639", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection."}, {"lang": "es", "value": "El binario upload.cgi, responsable de procesar las copias de seguridad del dispositivo, contiene una clave de cifrado AES codificada de forma r\u00edgida. Esto permite a un atacante descifrar, modificar y volver a cifrar las copias de seguridad del sistema, facilitando la inyecci\u00f3n persistente de puertas traseras."}], "lastModified": "2026-07-21T12:10:00.090", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:acer:wave_7_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A285046D-4F39-4F56-8274-B5880B1FB69E", "versionEndIncluding": "t7c_gbl_1.01.000055"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:acer:wave_7:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F5C30991-CFC8-41D4-9CA1-A29FA91496B6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "8fc372e3-d9c5-46e4-9410-38469745c639"}