CVE-2026-36609: High severity MERCUSYS AC12G (EU) V1 vulnerability
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)V1200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the authentication implementation so the nonce is randomly generated for each authentication request and do not use the predictable XOR-based securityEncode. Implement a secure challenge-response (e.g., HMAC-based) or other non-reversible authentication encoding.
Mercusys AC12G (EU) firmware (authentication) nonce_generation / securityEncode = use per-request cryptographically secure random nonce; replace XOR-based encoding - Configuration
Disable remote/remote-web/WAN management or restrict management access to a small set of trusted IP addresses or require management only over an authenticated VPN.
Router management interface remote_management = disabled or restricted to trusted IPs/VPN - Compensating control
Block or firewall off management ports (web UI, SSH, telnet, other admin interfaces) from untrusted networks/ WAN; allow access only from trusted management networks or through a VPN.
- Operational
Rotate administrative credentials on affected Mercusys AC12G devices (change passwords) and enforce strong, unique administrator passwords.
- Operational
Monitor the vendor for a firmware update that addresses the static nonce and XOR-based encoding issue and apply the vendor-supplied firmware patch as soon as it is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36609?
CVE-2026-36609 has a severity rating of high, with a CVSS score of 7.3.
How does CVE-2026-36609 affect the Mercusys AC12G (EU) V1 router?
CVE-2026-36609 affects the router by allowing attackers to exploit a static authentication nonce coupled with predictable XOR-based password encoding.
What can be done to mitigate CVE-2026-36609?
Mitigation for CVE-2026-36609 involves ensuring firmware updates are applied and avoiding the use of predictable passwords.
Are there any known exploits for CVE-2026-36609?
As of now, there are no publicly disclosed exploits specifically targeting CVE-2026-36609.
Can CVE-2026-36609 lead to unauthorized access?
Yes, CVE-2026-36609 can potentially lead to unauthorized access due to weaknesses in the authentication mechanism.