CVE-2026-49200CWE-532

Acer Wave 7 router: Broken Access Control

Critical · published May 29, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00615 · 48.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-05-29T08:51Z
EPSS history
Timeline
  • 29 MAY 08:51Z
    Acer Wave 7 router: Broken Access Control
    cvelistv5