CVE-2026-36607
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.
Risk Assessment
An attacker can brute-force the admin password, leading to full router compromise and access to the internal network.
Recommendation
Update the router firmware to a version that introduces rate limiting for the password change endpoint. Consider using strong passwords and enabling additional protections such as lockout after failed attempts.
Other vulnerabilities in Mercusys AC12G
See all- CVE-2026-36618Medium
The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version (unbound 1.22.0), aiding targeted attacks against known vulnerabilities.
- CVE-2026-36616Medium
The firmware of the Mercusys AC12G (EU) V1 router contains hardcoded WiFi driver credentials, including a RADIUS shared secret, WPS test key, and default PSK.
- CVE-2026-36615Medium
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticated attackers on the adjacent network.
- CVE-2026-36613Medium
The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers.
- CVE-2026-36612Medium
The Mercusys AC12G (EU) V1 router enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).
- CVE-2026-36611High
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.
- CVE-2026-36610Medium
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS implementation, allowing man-in-the-middle interception of DDNS service credentials.
- CVE-2026-36609High
The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.
- CVE-2026-36608High
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.
- CVE-2026-36606High
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.
Original NVD description (English source)
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.