CVE-2026-49200 Details
Description
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
An authentication bypass vulnerability has been identified in the web interface of certain Acer devices. The issue arises because the acer_cgi.log file is accessible without authentication, and this file contains cleartext login credentials for both web and Telnet access. As a result, unauthorized users can gain system access by exploiting this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://community.acer.com/en/kb/articles/19673 | Acer | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | Acer |
Affected Products
| Product | Versions |
|---|---|
| acer wave 7 firmware | <= t7c_gbl_1.01.000055 |
CPE
Remediation
| |
| acer wave 7 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | Acer |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | Initial Analysis | [email protected] |
| May 29, 2026 | New CVE Received | Acer |