CVE Feed

    Dashboard / CVE / CVE-2026-36609

    CVE-2026-36609

    Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.

    Published:Jun 3, 2026
    Last Modified:Jun 5, 2026
    EPS:Jun 3, 2026
    EPSS Score:0.0003
    CVSS Score:7.3

    Affected Products

    Vendor
    Mercusys
    Product
    Ac12g

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-36602 (CVSS 4.3) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP Ge…
    CVE-2026-36604 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabli…
    CVE-2026-36607 (CVSS 8.8) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via…
    CVE-2026-36605 (CVSS 6.5) — Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via …
    CVE-2026-36611 (CVSS 7.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiv…
    CVE-2026-36612 (CVSS 6.4) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy…
    CVE-2026-36615 (CVSS 4.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint th…
    CVE-2026-36616 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including …
    CVE-2026-36610 (CVSS 5.9) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with o…
    CVE-2026-36613 (CVSS 4.3) — Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High