The upload.cgi binary in the Acer Wave 7 router embeds a hard‑coded AES key, allowing an adversary to decrypt system backups, alter their contents, and re‑encrypt them with the same key. By modifying configuration data in this manner the attacker can introduce a persistent backdoor, compromise integrity and confidentiality of the router’s state, and evade future detection. The flaw is a classic example of inappropriate hard‑coded cryptographic material (CWE‑798).

Acer Wave 7 routers are affected. No specific firmware versions are listed in the advisory, but all builds that include the vulnerable upload.cgi binary are at risk.

The CVSS score of 10 indicates that exploiting this flaw would provide the attacker with high‑impact capabilities. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the absence of mitigation information means it can be continuously abused. Based on the description, the likely attack vector is the upload.cgi interface, which is reachable on the local network and requires authentication; an attacker who gains local or remote access to this endpoint can perform the exploit.