Vulnerability Details CVE-2026-49201
The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 9.2%
CVSS Severity
CVSS v3 Score 9.8
Products affected by CVE-2026-49201
-
cpe:2.3:h:acer:wave_7:-
-
cpe:2.3:o:acer:wave_7_firmware:t7c_gbl_1.01.000055