Detection Guidance

This vulnerability involves unauthorized access to the acer_cgi.log file via the web interface, which contains cleartext login credentials. To detect this vulnerability, you can attempt to access the acer_cgi.log file on the affected Acer Wave 7 router's web interface without authentication.

A simple method to check for this vulnerability is to use a command-line tool like curl or wget to request the acer_cgi.log file from the router's IP address.

• curl http://<router-ip>/acer_cgi.log
• wget http://<router-ip>/acer_cgi.log -O -

If the file is accessible without authentication and contains cleartext credentials, the device is vulnerable.

Useful 0 Not Useful 0

Executive Summary

This vulnerability involves the acer_cgi.log file in the device firmware being accessible without authentication through the web interface.

The log file contains cleartext login credentials for both web and Telnet access, which can be exploited to gain unauthorized system access.

Useful 0 Not Useful 0

Impact Analysis

An attacker can access the acer_cgi.log file without authentication and retrieve cleartext login credentials.

This can lead to unauthorized system access, potentially allowing the attacker to control the device, inject persistent backdoors, and compromise network security.

Useful 0 Not Useful 0

Mitigation Strategies

Users are strongly advised to update their Acer Wave 7 router firmware to the latest version once the security patch is released, which is planned by the end of June 2026.

Until the patch is available, avoid exposing the router's web interface to untrusted networks to reduce the risk of unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized access to cleartext login credentials via the acer_cgi.log file, which can lead to unauthorized system access. This exposure of sensitive authentication information can result in violations of data protection and security requirements mandated by standards such as GDPR and HIPAA, which require safeguarding of personal and sensitive data against unauthorized access.

Specifically, the lack of authentication and exposure of credentials could lead to breaches of confidentiality and integrity, undermining compliance with these regulations that mandate strict access controls and protection of sensitive information.

Useful 0 Not Useful 0