Unauthenticated Information Disclosure in Mercusys AC12G
CVE-2026-36615

4.3MEDIUM

Key Information:

Vendor

Mercusys

Status
AC12G
Vendor
CVE Published:
3 June 2026

What is CVE-2026-36615?

The Mercusys AC12G (EU) V1 with firmware version AC12G(EU)_V1_200909 includes an undocumented /agileconfigreset endpoint that inadvertently exposes sensitive internal buffer contents. This security lapse allows unauthenticated attackers on the adjacent network to harvest critical system information, which could lead to further exploitation or attacks, emphasizing the importance of proper access controls and regular firmware updates.

References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.