Acer has acknowledged two significant zero-day vulnerabilities in its Wave 7 mesh routers, which impact devices running firmware version T7c_GBL_1.01.000055 or earlier. The first vulnerability, identified as CVE-2026-49200, allows unauthenticated attackers to access plaintext login credentials stored in log files through the device's web interface. The second, CVE-2026-49201, involves a hardcoded AES encryption key that grants remote attackers persistent backdoor access to the router. Acer is currently developing patches for these vulnerabilities, with a target release date set for the end of June 2026. In the interim, the company strongly advises users to disable remote management features and restrict Internet access to trusted IP addresses only. Users can also prepare for the upcoming firmware updates by following specific steps to check for updates once they are released.