Buffer Overflow Vulnerability in Mercusys AC12G Router

CVE-2026-36611

What is CVE-2026-36611?

The Mercusys AC12G (EU) V1 router is susceptible to a buffer overflow vulnerability. This occurs when the device processes POST requests on the UPnP port (1900) without a SOAPAction header. Specifically, the router returns 128 bytes of uninitialized buffer data, which can potentially expose sensitive internal memory to unauthorized adjacent network attackers. This flaw may allow attackers to exploit this exposure to execute unauthorized actions or gain further access to the device.

References