Information disclosure in Acer Wave 7 Router

CVE-2026-49200

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

EPSS: 0.001 (18.7th percentile) — read the EPSS interpretation.