CVE-2026-36605: Medium severity MERCUSYS AC12G (EU) V1 vulnerability
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)V1200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, causing a persistent crash that requires physical power cycling to recover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict or block access to the router's HTTP management interface from untrusted networks (e.g., block TCP/HTTP to the device at the network edge or allow access only from trusted IP addresses) to reduce exposure to crafted incomplete HTTP requests.
- Operational
If the device becomes unresponsive due to this vulnerability, restore service by physically power cycling the router (remove and restore mains power or use the device power switch), since the crash requires physical power cycling to recover.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36605?
The severity of CVE-2026-36605 is rated as medium with a score of 6.5 on the CVSS scale.
How do I fix CVE-2026-36605?
To mitigate CVE-2026-36605, users should update the Mercusys AC12G (EU) router firmware to a version that addresses this vulnerability.
What type of attack is CVE-2026-36605 vulnerable to?
CVE-2026-36605 is vulnerable to an HTTP denial of service attack via crafted incomplete HTTP requests.
What impact does CVE-2026-36605 have on the router?
The impact of CVE-2026-36605 is a persistent crash of the Mercusys AC12G router requiring physical power cycling to recover.
Is physical access required to exploit CVE-2026-36605?
No, physical access is not required to exploit CVE-2026-36605 as it can be triggered remotely through crafted HTTP requests.