CVE-2026-36606
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.
Risk Assessment
An attacker with access to the configuration backup file can obtain all network and administrative credentials, allowing full compromise of the router and network.
Recommendation
Change the default admin password and Wi-Fi key, and consider replacing the router with a model that uses stronger backup encryption.
Other vulnerabilities in Mercusys AC12G
See all- CVE-2026-36618Medium
The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version (unbound 1.22.0), aiding targeted attacks against known vulnerabilities.
- CVE-2026-36616Medium
The firmware of the Mercusys AC12G (EU) V1 router contains hardcoded WiFi driver credentials, including a RADIUS shared secret, WPS test key, and default PSK.
- CVE-2026-36615Medium
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticated attackers on the adjacent network.
- CVE-2026-36613Medium
The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers.
- CVE-2026-36612Medium
The Mercusys AC12G (EU) V1 router enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).
- CVE-2026-36611High
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.
- CVE-2026-36610Medium
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS implementation, allowing man-in-the-middle interception of DDNS service credentials.
- CVE-2026-36609High
The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.
- CVE-2026-36608High
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.
- CVE-2026-36607High
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.
Original NVD description (English source)
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.