they cant keep getting away with this...

Two critical CVEs (CVSS 10.0) in Acer Wave 7 routers are examined in detail. The first is a broken access control flaw where a CGI log file containing cleartext login credentials for web and Telnet interfaces is accessible without authentication. The second is a hardcoded AES encryption key in the upload.cgi binary used for device backups, allowing attackers to decrypt, modify, and re-encrypt backups to inject persistent backdoors. The broader trend of poor security practices across router manufacturers is discussed, with practical advice to disable remote web interface access to reduce exposure.