CVE Feed

    Dashboard / CVE / CVE-2026-36608

    CVE-2026-36608

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.

    Published:Jun 3, 2026
    Last Modified:Jun 5, 2026
    EPS:Jun 3, 2026
    EPSS Score:0.00016
    CVSS Score:8.8

    Affected Products

    Vendor
    Mercusys
    Product
    Ac12g

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-219 XML Routing Detour Attacks
    CAPEC-465 Transparent Proxy Abuse

    Related CVEs

    CVE-2026-36602 (CVSS 4.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP Ge…
    CVE-2026-36604 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabli…
    CVE-2026-36607 (CVSS 8.8) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via…
    CVE-2026-36609 (CVSS 7.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does n…
    CVE-2026-36605 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via …
    CVE-2026-36611 (CVSS 7.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiv…
    CVE-2026-36612 (CVSS 6.4) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy…
    CVE-2026-36615 (CVSS 4.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint th…
    CVE-2026-36616 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including …
    CVE-2026-36610 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High