Acer Wave 7 Router Hardcoded Key and Broken Access Control Advisory

Vulnerability Overview Acer has received notifications regarding system vulnerabilities in the Acer Wave 7 router, which were identified through independent security research. These vulnerabilities primarily concern access control structures and firmware encryption protection mechanisms, and are currently being actively addressed. Scope of Impact Affected Versions: Acer Wave 7 routers running firmware version T7c_GBL_1.01.000055 or earlier. Remediation Vulnerability Details: 1. Broken Access Control - Description: The file in the device firmware is accessible via the web interface without authentication (including Web and Telnet), leading to unauthorized system access. This file contains plaintext login credentials. - Severity Rating: Critical (10.0) - CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VE:H/VA:H - CWE Identifier: CWE-532: Insertion of Sensitive Information into Log File 2. Hardcoded Cryptographic Key - Description: The binary, which handles device backups, contains a hardcoded AES encryption key. This allows attackers to decrypt, modify, and re-encrypt system backups, facilitating the injection of persistent backdoors. - Severity Rating: Critical (10.0) - CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VE:H/VA:H/SC:H/SH:H/SA:H - CWE Identifier: CWE-798: Use of Hard-coded Credentials Solution: - The above vulnerabilities are scheduled to be resolved through an upcoming firmware update. The targeted fix is expected to be deployed by the end of June 2026. How to Update Your Firmware: 1. Connect your computer to the Acer Wave 7 router via an Ethernet cable or Wi-Fi network. 2. Open a web browser and navigate to the router management console (http://192.168.78.1 or http://acerconnect.com). 3. Log in using administrator credentials. 4. Navigate to "System Management" and select "Firmware Update". 5. Select "Check for Updates". Note: Do not restart or unplug the router during the update process. Credit Acer thanks security researcher Gergo Pap for discovering and reporting these issues. Disclaimer The information above is provided "as is" in connection with Acer products and their suppliers. You assume the risk of using the information or materials linked from this page. Acer reserves the right to change or update the content of this page at any time.

Goal Reached Thanks to every supporter — we hit 100%!

Acer Wave 7 Router Hardcoded Key and Broken Access Control Advisory

More from this source