10.0 CriticalCWE-798
CVE-2026-49201
Acer Wave 7 router: Hardcoded Cryptographic Key
AcerWave 7 router
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 23 Oct
0.3%probability of exploitation in the next 30 days
Higher than 23% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
Coverage 1 article · 1 outlet
- Critical flaws in Acer Wave 7 leak credentials, enable backdoorsSecurityOnline · first in our coverage · mentions it in passing