CVE Feed

    Dashboard / CVE / CVE-2026-36603

    CVE-2026-36603

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.

    Published:Jun 3, 2026
    Last Modified:Jun 5, 2026
    EPS:Jun 3, 2026
    EPSS Score:0.00022
    CVSS Score:8.1

    Affected Products

    Vendor
    Mercusys
    Product
    Ac12g

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-36602 (CVSS 4.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP Ge…
    CVE-2026-36604 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabli…
    CVE-2026-36607 (CVSS 8.8) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via…
    CVE-2026-36609 (CVSS 7.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does n…
    CVE-2026-36605 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via …
    CVE-2026-36611 (CVSS 7.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiv…
    CVE-2026-36612 (CVSS 6.4) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy…
    CVE-2026-36615 (CVSS 4.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint th…
    CVE-2026-36616 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including …
    CVE-2026-36610 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High