# CVE-2026-49200: Acer Wave 7 Router information disclosure in acer_cgi.log

Source: https://junglewise.ai/threats/cve-2026-49200-acer-wave-7-router-information-disclosure-in-acer-cgi-log  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-49200 · Severity: info · CVSS 10 · Published 2026-05-29

The Acer Wave 7 router contains a security flaw where sensitive system logs are accessible to anyone on the network without a password. These logs contain the administrator's login credentials for both the web management interface and remote terminal access (Telnet) in plain text. An attacker can use this information to take full control of the router, potentially monitoring network traffic, changing security settings, or disrupting internet connectivity.

Vendors: [Acer](https://junglewise.ai/threats/vendors/acer).

## Quick answers

**Is CVE-2026-49200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49200 being exploited in the wild.

**How severe is CVE-2026-49200?** Informational severity, with a CVSS score of 10, published 29 May 2026.

**Which products and versions are affected?** Acer Wave 7 Router T7c_GBL_1.01.000055 and earlier.

**Is there a fix for CVE-2026-49200?** A patch was published on 2026-06-30: Target date for firmware update deployment Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49200 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49200?** Check whether you run Acer Wave 7 Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the Acer Wave 7 router firmware (version T7c_GBL_1.01.000055 and earlier) due to improper protection of log files. The file 'acer_cgi.log' is exposed via the web server and can be retrieved by unauthenticated remote attackers. This log file contains sensitive information, specifically cleartext credentials for the web administration interface and Telnet service. Successful exploitation allows an attacker to gain full administrative access to the device. Acer has announced that a fix is planned for deployment by the end of June 2026.

## Affected products

- Acer Wave 7 Router T7c_GBL_1.01.000055 and earlier

## Timeline

- 2026-05-29: advisory: Initial disclosure by Acer and NVD publication
- 2026-06-30: patched: Target date for firmware update deployment

## References

- [https://community.acer.com/en/kb/articles/19673](https://community.acer.com/en/kb/articles/19673)

## Related threats

- [Acer Wave 7 Router hardcoded AES key in upload.cgi](https://junglewise.ai/threats/cve-2026-49201-acer-wave-7-router-hardcoded-aes-key-in-upload-cgi)