CVE-2026-49200
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.
Risk Assessment
An attacker can gain full device access by compromising administrative accounts, enabling configuration changes, data theft, or using the device as an entry point into the internal network.
Recommendation
Immediately block access to the acer_cgi.log file via firewall rules or web server configuration, and change all credentials stored in this file.
Original NVD description (English source)
The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.