Security alert: two critical vulnerabilities in Acer Wave 7 routers could expose credentials and allow back doors

Acer has confirmed that he is working on patches for two most serious vulnerabilities that affect his Wave 7 mesh routers with T7c _ GBL _ 1.01.000055 firmware or earlier versions. These failures, reported by the researcher Gergo Pap, are not theoretical: they allow from remote reading of credentials stored in clear text to persistent injection of back doors by handling encrypted backup, so they should be treated as immediate security priorities. You can check Acer's official notice here: Acer's safety notice.

The first vulnerability (CVE-2026-49200) exposes an accessible unauthenticated registry file that contains clear credentials; this means that a remote assailant without permission can download that record and get user names and web and Telnet access passwords from the device. The second (CVE-2026-49201) is derived from a AES key included in the binary in charge of processing backup, which allows an attacker to decipher copies, alter them, and reencrypt them to restore them, thus introducing persistent changes that would survive a reset or superficial restorations. Both failures are documented in the national vulnerability database: CVE-2026-49200 and CVE-2026-49201.

The practical risk is high. With clear text credentials, an attacker can take administrative control of the router, modify NAT / Firewall rules, redirect DNS traffic, install tunnels or deploy malware on the local network. With the possibility of rewriting back-up, an opponent can insert a back door that remains after a restoration, complicating cleaning and detection. These vectors are especially dangerous in domestic environments and small offices where the router is the first and only control point between the local network and the Internet.

Acer indicates that the corrections will be ready by the end of June 2026, but in the meantime users should reduce their exposure. The most urgent recommendation is disable any remote access to the management panel from the Internet; if the firmware allows to filter reliable IP addresses for remote management, activate it only with static and reliable PIs. In addition, it updates management credentials with robust and unique passwords, and prevents the use of unsafe services such as Telnet if they can be disabled or replaced by safe alternatives.

When Acer publishes the update, apply it as soon as possible following the manufacturer's instructions to minimize errors: connect directly to Ethernet if possible, check the version before and after the update and do not interrupt the process. After updating, it is advisable to change the administrative passwords again, review modified accounts and configurations and restore configurations from a well-known and verified copy instead of a backup generated by a potentially vulnerable firmware. Follow the official update steps indicated by Acer in your notice to avoid failures during the process.

If you suspect that your device could be compromised before updating, consider a factory reboot and, if the threat persists or the cleaning is complex, replace the equipment with another with active support. It monitors unexpected outgoing connections from the network, reviews the list of connected devices and looks for signs of unauthorized changes in DNS or port forwarding rules, because these modifications are usually persistent control indicators.

Beyond the concrete emergency, this incident highlights two general lessons: on the one hand, avoid storing credentials in clear text or easily accessible files on embedded devices and, on the other hand, do not use hard-wired cryptographic keys in binaries that process backups or configurations. Manufacturers should apply good practices for safe development and key rotation; managers and users should require transparency and regular firmware updates.

For those who want to deepen the technical details and status of these failures, check the entries in the vulnerability database: detail of CVE-2026-49200 and detail of CVE-2026-49201, and remain subscribed to the Acer ad channel to receive the official update. Acting now results in a lower likelihood of intrusion and a simpler recovery when the patch is distributed.