CVE-2026-36613: Medium severity MERCUSYS AC12G (EU) V1 vulnerability
Mercusys AC12G (EU) V1 with firmware AC12G(EU)V1200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the device's HTTP/web management interface or remote HTTP management if it is not required to eliminate exposure to unauthenticated HTTP POST requests to undefined paths.
Mercusys AC12G web management interface web/HTTP management = disabled (if not required) - Compensating control
Restrict access to the device's management interface to trusted hosts only (firewall/ACLs/VLANs). Block or drop HTTP POST requests from untrusted/adjacent networks to the device; place the device management interface on an isolated management network.
- Operational
Contact the vendor for a firmware fix/patch and apply any provided update when available. In the meantime, monitor network logs for unexpected HTTP POST requests to undefined paths and for responses exposing internal data (e.g., 128-byte responses), and investigate any such occurrences.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36613?
CVE-2026-36613 has a medium severity rating of 4.3 on the CVSS scale.
How do I fix CVE-2026-36613?
To address CVE-2026-36613, update the firmware of the Mercusys AC12G (EU) V1 to the latest version available from the manufacturer.
What is the impact of CVE-2026-36613?
CVE-2026-36613 can expose internal buffer contents to unauthenticated adjacent network attackers when certain HTTP POST requests are made.
Who is affected by CVE-2026-36613?
CVE-2026-36613 affects users of the Mercusys AC12G (EU) V1 with the specified firmware version.
What type of vulnerability is CVE-2026-36613?
CVE-2026-36613 is classified as an information disclosure vulnerability.