CVE-2026-49201: Acer Wave 7 Firmware

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

Affected products

• Acer Wave 7 Firmware: up to and including t7c_gbl_1.01.000055

Published 2026-05-29. Last modified 2026-07-21.