CVE-2026-36608: High severity MERCUSYS AC12G (EU) V1 router vulnerability
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)V1200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the router's UPnP (IGD) service to prevent AddPortMapping SOAP requests from creating port mappings that could expose the admin interface.
Mercusys AC12G (EU) V1 firmware AC12G(EU)_V1_200909 - UPnP service upnp_enabled = false - Configuration
Configure UPnP to reject AddPortMapping requests where InternalClient equals the router's own IP (192.168.1.1) or localhost (127.0.0.1), preventing mappings to the admin interface.
Mercusys AC12G (EU) V1 firmware AC12G(EU)_V1_200909 - UPnP handling UPnP InternalClient validation = reject 192.168.1.1 and 127.0.0.1 - Compensating control
Block or filter WAN access to the router administration interface (HTTP/HTTPS and management ports) at the network perimeter; restrict remote management to specific trusted IPs or require access via VPN.
- Operational
Audit the router for existing UPnP-created port mappings forwarding external ports to 192.168.1.1 or 127.0.0.1, remove any such mappings, and review logs for AddPortMapping requests from the LAN.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36608?
The severity of CVE-2026-36608 is high, with a CVSS score of 8.8.
How do I fix CVE-2026-36608?
To fix CVE-2026-36608, disable UPnP functionality on the Mercusys AC12G (EU) V1 router.
What vulnerabilities does CVE-2026-36608 introduce?
CVE-2026-36608 allows an unauthenticated LAN attacker to expose the router's admin panel, risking unauthorized access.
Which router models are affected by CVE-2026-36608?
CVE-2026-36608 affects the Mercusys AC12G (EU) V1 router.
Can this vulnerability be exploited remotely?
No, CVE-2026-36608 can only be exploited by an attacker on the local network.