Loading story…
Acer disclosed two critical zero-day vulnerabilities affecting Wave 7 mesh routers running firmware T7c_GBL_1.01.000055 or earlier, both assigned a CVSS score of 10.0. The flaws, reported by researcher Gergo Pap, are tracked as CVE-2026-49200 and CVE-2026-49201. The first allows unauthenticated attackers to access the internal acer_cgi.log file through the web interface and recover plaintext administrative credentials for the web and Telnet services.
The second vulnerability stems from a hardcoded AES key in the upload.cgi backup-processing component, allowing attackers to decrypt, modify, and re-encrypt router backup files to implant persistent backdoors. Acer said emergency firmware updates were still in development and targeted for release by the end of June 2026. Until patches are available, the company urged customers to disable remote management or restrict Internet access to trusted IP addresses only, and to monitor the router management interface for firmware updates and apply them immediately once released.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
At disclosure time, Acer said patches were not yet available and that emergency firmware updates were targeted for release by the end of June 2026. Until then, the company advised customers to monitor for updates and limit or disable remote management access.
Acer acknowledged and disclosed two maximum-severity flaws affecting Wave 7 devices: CVE-2026-49200, which exposes plaintext administrative credentials via acer_cgi.log, and CVE-2026-49201, which uses a hardcoded AES key to enable tampering with backups for persistent backdoor insertion. Both references describe the vulnerabilities as affecting firmware version T7c_GBL_1.01.000055 or earlier.
Security researcher Gergo Pap reported two vulnerabilities in Acer Wave 7 mesh routers running firmware T7c_GBL_1.01.000055 or earlier. The issues were later tracked as CVE-2026-49200 and CVE-2026-49201.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ASUS has released firmware and software updates for seven vulnerabilities across ASUSWRT routers and several Windows components, led by **CVE-2026-13385**, a critical router flaw rated **CVSS 9.5**. The issue affects CN SKU ASUS routers using the UU feature and, according to ASUS advisories, could let a machine-in-the-middle attacker spoof the update server and execute arbitrary commands without credentials; other reporting describes the bug as stemming from improper input validation in router management components and affecting firmware branches including `3.0.0.4_386`, `3.0.0.4_388`, and `3.0.0.6_102`. Successful exploitation could give attackers control of edge devices, enabling traffic interception, malware deployment, and broader network compromise. The broader advisory set also covers flaws in **ASUS System Control Interface v3**, **ASUS Business Manager**, **Aura Wallpaper Service**, **GameSDK**, and router web interfaces, with impacts including physical memory access, information disclosure, denial of service, unauthorized file operations, credential exposure, and data tampering. ASUS said none of the vulnerabilities are confirmed to be under active exploitation and that no public proof-of-concept is known for the critical router issue, but urged customers to apply updates immediately, disable remote administration or affected router features if patching is delayed, restrict management access to trusted IP ranges, use strong credentials, and replace end-of-life routers no longer supported after March 2026.
Jul 22, 2026
CERT/CC disclosed an unpatched authentication backdoor in firmware used by several older **Tenda** Wi-Fi routers, tracked as `CVE-2026-11405`, that can let attackers bypass normal web login and gain administrator access. The flaw lies in the router web interface's login logic, which reportedly falls back to a secondary authentication path after a failed login attempt and validates only a stored password value instead of both username and password. Researchers said the alternate password appears to be **`rzadmin`**, and because the username is not checked, an attacker may be able to log in with any username paired with the backdoor password. The affected issue spans five firmware versions across multiple Tenda models, and no official vendor patch was available at disclosure. Successful exploitation could allow attackers to change router settings, disable security protections, and potentially compromise connected local networks. Reporting on the disclosure also pointed to a broader pattern of security problems in Tenda devices, citing earlier hardcoded credential exposure, `CVE-2020-35391` in the Tenda N300 that exposed configuration data and administrative passwords, and `CVE-2026-36794`, a denial-of-service flaw in the Tenda W3. CERT/CC advised users to disable remote web management, change the default LAN IP address, and replace unsupported devices if updates are unavailable.
Jul 20, 2026
Two high-severity vulnerabilities have been disclosed in Tenda router firmware, affecting **Tenda AC5** version `15.03.06.47` and **Tenda AC6** version `15.03.05.16`. The flaws reside in the `formQuickIndex` function behind the `/goform/QuickIndex` POST request handler, where improper handling of the `PPPOEPassword` parameter can trigger a **stack-based buffer overflow**. Both issues are tracked as `CVE-2026-4903` for AC5 and `CVE-2026-4961` for AC6. The vulnerabilities are described as **remotely exploitable**, with **public exploits available**, raising the risk of real-world attacks against exposed devices. The entries map the weaknesses to `CWE-119` and `CWE-121`, and their published CVSS vectors indicate high impact across **confidentiality, integrity, and availability**, making these flaws significant for organizations or users still operating the affected firmware.
Jun 29, 2026