CVE-2026-78861
UnknownSummary
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key.
Risk Assessment
A local attacker could use the known private key to impersonate or decrypt communications, leading to arbitrary code execution and device compromise. This may threaten network integrity and confidentiality.
Recommendation
Update the device firmware if the vendor has released a fix removing the hardcoded key. Otherwise, consider replacing the device with a model not affected by this issue.
Other vulnerabilities in Mercusys AC12 V2
See all- CVE-2026-78862Unknown
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB).
- CVE-2026-78860Unknown
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext.
Original NVD description (English source)
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key
Vulnerability data from NVD (NIST) · CISA KEV · EPSS