Independent security researcher Gergo Pap has identified a maximum-severity zero-day vulnerability, designated CVE-2026-49200, affecting Acer Wave 7 mesh routers. The flaw is a broken access control vulnerability within the router management interface that allows unauthenticated remote attackers to access and retrieve router log archive files. These archives contain sensitive administrative credentials in plaintext format, facilitating complete system compromise. By exploiting this vector, an attacker can bypass standard authentication protocols, gain unauthorized access to the device, and execute lateral movement within the protected network. Acer is currently developing and deploying firmware updates to mitigate this critical information disclosure and access control risk.

• Vulnerability Overview

  • Identified as CVE-2026-49200, representing a maximum-severity security flaw.
  • Classified as a Broken Access Control and Information Disclosure vulnerability.
  • Discovered and disclosed by independent researcher Gergo Pap.
  • Primarily impacts Acer Wave 7 Mesh Router firmware versions prior to current security patches.

• Vulnerability Mechanics

  • Targets specific implementation flaws within the router's management interface.
  • Exploits broken access control logic to bypass standard authentication requirements.
  • Facilitates unauthenticated remote access to sensitive router log archive files.
  • Leverages the exposure of plaintext credentials within those logs to achieve full administrative control.

• Impact and Exploitation Risks

  • Potential CVSS score of 10.0 due to the remote, unauthenticated attack vector.
  • Enables complete takeover of the mesh router hardware and its management capabilities.
  • Provides a direct pathway for credential theft and subsequent lateral movement.
  • Risks the total compromise of the protected network environment behind the mesh system.

• Remediation and Defensive Actions

  • Acer Security Advisory/Response Team is actively engineering and deploying firmware mitigations.
  • Security administrators should conduct immediate audits of all Acer Wave 7 hardware in their infrastructure.
  • Monitor management interface traffic for anomalous requests targeting log archive files.
  • Prioritize the installation of official vendor firmware updates immediately upon release.