CVE Feed

    Dashboard / CVE / CVE-2026-36606

    CVE-2026-36606

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.

    Published:Jun 3, 2026
    Last Modified:Jun 5, 2026
    EPS:Jun 3, 2026
    EPSS Score:0.00011
    CVSS Score:7.1

    Affected Products

    Vendor
    Mercusys
    Product
    Ac12g

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2026-36602 (CVSS 4.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP Ge…
    CVE-2026-36604 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabli…
    CVE-2026-36607 (CVSS 8.8) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via…
    CVE-2026-36609 (CVSS 7.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does n…
    CVE-2026-36605 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via …
    CVE-2026-36611 (CVSS 7.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiv…
    CVE-2026-36612 (CVSS 6.4) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy…
    CVE-2026-36615 (CVSS 4.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint th…
    CVE-2026-36616 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including …
    CVE-2026-36610 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High