CVE-2026-49201

The upload.cgi binary stores the AES key directly in the application code, with no possibility of changing it by the user or administrator. An attacker who obtains a device backup file can use this key to decrypt it, introduce malicious modifications, and then re-encrypt the modified file. Such a prepared backup can be restored on the device, resulting in permanent embedding of a backdoor in the system.

An attacker can gain persistent, unauthorized control over the device by injecting a backdoor through a manipulated backup. The high CVSS score of 10.0 indicates a complete breach of confidentiality, integrity, and availability of both the target system and related systems.

Apply patches available from the manufacturer according to the references (https://community.acer.com/en/kb/articles/19673). Due to the hardcoded cryptographic key, the only effective solution is a firmware update that provides a new implementation without hardcoded credentials.

Devices using the binary upload.cgi component for backup handling — detailed information about versions is indicated in the manufacturer's references (Acer).