CVE-2026-49201: Acer Wave 7 router: Hardcoded Cryptographic Key

Synopsis

A hardcoded AES key in the upload.cgi binary on Acer Wave 7 routers lets anyone who obtains a device backup decrypt it, tamper with its contents, and re-encrypt it so the device accepts the modified file. The flaw is reachable over the network with no authentication and no user interaction, and successful exploitation enables persistent backdoor injection with full read, write, and availability impact on the device and connected systems. No fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's upload.cgi endpoint over the network (AV:N).

• AuthenticationNot required

  No credentials are needed; PR:N means the endpoint is exploitable by an unauthenticated attacker.

• Victim interactionNot required

  UI:N: no user has to click, open, or approve anything for the exploit to succeed.

• Attack complexityDetail

  AC:L with AT:N: the hardcoded key is static, so the exploit is reliable and free of timing or environmental preconditions.

Blast Radius

• Decrypts intercepted or extracted device backups and reads their full contents, including configuration and any embedded secrets.
• Modifies backup contents and re-encrypts them with the hardcoded key so the device accepts tampered backups, enabling persistent backdoor injection.
• Leverages the modified backup to gain durable control of the router, affecting integrity and availability of traffic passing through it.
• Pivots into connected systems on the network the router fronts, with high confidentiality, integrity, and availability impact on those subsequent systems (SC:H/SI:H/SA:H).