CVE-2026-36610: Medium severity MERCUSYS AC12G (EU) V1 vulnerability
Mercusys AC12G (EU) V1 with firmware AC12G(EU)V1200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS implementation, allowing man-in-the-middle interception of DDNS service credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the DDNS feature and remove any configured DDNS credentials on the device to prevent transmission of credentials in plaintext.
Mercusys AC12G (EU) V1 firmware AC12G(EU)_V1_200909 DDNS = disabled - Compensating control
At the network perimeter, block or restrict outbound HTTP (port 80) connections from the router to DDNS providers and restrict administrative/management access to the device to trusted IPs via firewall/ACLs to reduce risk of credential interception.
- Operational
Rotate DDNS service credentials (change passwords) and any potentially exposed credentials; assume interception if DDNS was used and update credentials accordingly.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36610?
CVE-2026-36610 has a severity rating of medium with a CVSS score of 5.9.
How do I fix CVE-2026-36610?
To fix CVE-2026-36610, update the firmware of the Mercusys AC12G (EU) V1 to the latest version that addresses this vulnerability.
What are the risks associated with CVE-2026-36610?
The risks associated with CVE-2026-36610 include potential man-in-the-middle attacks that can expose DDNS credentials transmitted in plaintext.
Is my device affected by CVE-2026-36610?
If you are using Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909, your device is affected by CVE-2026-36610.
What type of data is exposed in CVE-2026-36610?
CVE-2026-36610 exposes DDNS credentials transmitted over HTTP in plaintext with only Base64 encoding.