CVE-2026-49201 is a critical (CVSS 9.8) flaw in Acer Wave 7 firmware. The upload.cgi binary that processes device backups uses a hard-coded AES key, so backups can be decrypted, changed and re-encrypted, which can plant a persistent backdoor. Check Acer's advisory (article 19673) for the fix.
What's affected
- Product: Acer Wave 7, hardware and firmware.
- Fixed version: not stated in the CVE record. Check Acer's advisory (article 19673).
- Weakness: CWE-798, use of hard-coded credentials.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Published 29 May 2026. Not marked as exploited in CISA KEV.
See also CVE-2026-49200 for another issue in the same device.
How to check if you're exposed
Acer ships these devices as consumer networking hardware, so there is no package manager to query. Use the device itself.
- Log in to the Acer Wave 7 admin page or the Acer Connect app and note the firmware version shown in the device or system information screen.
- Open the Acer advisory named in the Sources section and compare your version with the fixed firmware it lists.
- If the admin page or any service on the device is reachable from the internet, treat that as a separate problem and close it, whatever the firmware version.
Treat any backup file from this device as sensitive. If you keep exported configuration backups in shared storage, move them somewhere access controlled.
What to do now
- Open the Acer advisory (knowledge base article 19673) and confirm which Acer Wave 7 firmware fixes this CVE. The CVE record does not name a fixed version, so do not assume one.
- Install the fixed firmware through the vendor update path as soon as it is available for your unit.
- Until then, keep the admin interface off the internet and limit it to a trusted management network.
- Change any password or key that was stored on or sent through the device if you think it may have been exposed.
- Add the device to your asset inventory with its firmware version so the next advisory is easy to match.
- Do not restore a configuration backup that came from an untrusted source or location.
Why it matters
A backup file is a trust boundary. When the encryption key is the same on every device and sits inside the firmware, encryption no longer proves who made the file. Whoever extracts the key can open a backup, edit it, and make a new one that the device accepts.
That is how a configuration restore turns into persistence. The fix is per-device keys, or signing backups with a key that never leaves the vendor. The record classifies this as CWE-798.
Quick check
Can I tell if a backup was altered?
Not reliably with the weakness the record describes. Prefer backups you created yourself and stored securely, and apply the firmware fix.
Sources
- Acer knowledge base article 19673 (named in the CVE record; the page was behind a browser check when I tried to read it, so the details here come from the CVE record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
