Brute-Force Vulnerability in Mercusys AC12G Router
CVE-2026-36607

8.8HIGH

Key Information:

Vendor

Mercusys

Status
AC12G Router
Vendor
CVE Published:
3 June 2026

What is CVE-2026-36607?

The Mercusys AC12G (EU) V1 router's firmware is susceptible to unauthenticated brute-force attacks through its TDDP password change endpoint. This vulnerability arises because the endpoint does not implement adequate rate limiting compared to the login endpoint. As a result, an attacker within the same local network can exploit this weakness to make unlimited password guesses without fear of account lockout, potentially compromising the device security.

References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.