Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Mercusys AC12G exposes internal memory to network attackers

CVE-2026-36611 · published 5 months ago
Summary

A specific version of the Mercusys AC12G router returns sensitive memory information when receiving certain network requests, potentially allowing nearby attackers to access internal data. This affects the router's security and may allow unauthorized access to the network. To protect your network, update the router's firmware to a version that fixes this issue.

Original advisory text
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory...
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published3 Jun 2026
Updated4 Nov 2026
First seen3 Jun 2026
Sources
CVE-2026-36611 · NVD
Track software like this
Free during beta