Kernel Memory Exposure in Mercusys AC12G Router
CVE-2026-36602

4.3MEDIUM

Key Information:

Vendor

Mercusys

Status
AC12G Router
Vendor
CVE Published:
3 June 2026

What is CVE-2026-36602?

The Mercusys AC12G (EU) V1 router is susceptible to a vulnerability that allows an unauthenticated attacker on the adjacent network to exploit the UPnP GetStatusInfo function, thereby exposing a raw MIPS KSEG0 kernel pointer. This leakage of kernel memory layout information can facilitate further attacks, compromising the security and integrity of the device.

References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.