CVE-2026-36602: Mercusys AC12G Kernel Memory Disclosure via UPnP

Technical summary

The vulnerability is an information disclosure issue in the UPnP GetStatusInfo action handler. The affected firmware fails to sanitize kernel memory pointers before returning them in UPnP responses. Specifically, a MIPS KSEG0 kernel pointer is leaked, allowing an unauthenticated, adjacent-network attacker to infer the kernel's virtual memory layout. KSEG0 is a cached, unmapped segment in MIPS architecture where the kernel typically resides; its disclosure defeats address space layout randomization (ASLR) protections on the device. This information is valuable for chaining with other vulnerabilities to achieve code execution or privilege escalation.

Business impact

For organizations relying on Mercusys AC12G routers, this vulnerability degrades the security posture of the network perimeter. While not immediately exploitable for full compromise, it significantly accelerates attack development against the device. Attackers who identify this router on a network can extract memory layout information as a precursor to launching a targeted exploit. The adjacent-network requirement limits the attack surface to local and guest networks, but in BYOD or shared-network environments, this remains a material risk. Remediation delays increase exposure to multi-stage compromise chains.

Affected systems

Mercusys AC12G (EU) V1 router running firmware version AC12G(EU)_V1_200909. The vulnerability is specific to this firmware version; later firmware releases may or may not be affected. Mercusys devices are commonly deployed in small office and home office (SOHO) environments as well as enterprise branch offices. Any network hosting this exact hardware and firmware combination is at risk if the router is accessible to untrusted adjacent network segments (guest networks, corporate wireless, etc.).

Exploitability

Exploitability is straightforward from a technical standpoint: an unauthenticated attacker on the adjacent network (same LAN, wireless network, or VPN segment) can trigger the UPnP GetStatusInfo action and parse the response to extract the kernel pointer. No authentication is required, no user interaction is necessary, and no special privileges are required on the attacker's end. The attack is passive from the victim's perspective and leaves minimal forensic evidence. However, exploitation requires the attacker to be on the adjacent network and to actively query the UPnP service, which may be blocked by firewall rules or network segmentation. The CVSS score of 4.3 (Medium) reflects that while disclosure occurs and attack complexity is low, impact is limited to confidentiality and the attack surface is restricted to adjacent networks.

Remediation

Upgrade to a patched firmware version released by Mercusys that addresses the UPnP pointer disclosure. Verify the firmware version on affected routers and contact Mercusys support or check their firmware download page for available updates. In the interim, restrict UPnP access to trusted network segments only and disable UPnP on the router's WAN interface if not required. Network segmentation—isolating guest and untrusted networks from administrative network segments—also reduces the risk of an attacker leveraging this disclosure to compromise critical systems.

Patch guidance

Check the Mercusys support portal or the router's admin interface for the latest available firmware version. The current affected version is AC12G(EU)_V1_200909. Upgrade via the router's web admin panel (System Tools > Firmware) or download the firmware file directly from Mercusys and perform a manual update. Ensure the router is connected to power and an active network during the update process. Verify the update was successful by confirming the new firmware version in the System Settings page post-reboot. Document the update timestamp for compliance records.

Detection guidance

Monitor UPnP traffic on your network for GetStatusInfo queries to Mercusys devices, particularly from unexpected or untrusted source IP addresses. Network IDS/IPS solutions can detect UPnP discovery and exploitation patterns. Endpoint detection and response (EDR) tools may flag suspicious processes attempting to parse UPnP responses. On the router itself, enable debug logging if available and review logs for UPnP service access. Perform inventory scans to identify all Mercusys AC12G devices and confirm their firmware versions; automated vulnerability scanners that check UPnP endpoint responses can help flag exposure. Consider disabling UPnP entirely if not operationally required and replacing it with more secure alternatives like UPNP-IGD over HTTPS.

Why prioritize this

This vulnerability should be prioritized for patching in environments where Mercusys AC12G (EU) V1 routers are deployed, particularly in networks with guest or untrusted adjacent segments. While the CVSS score is Medium and the exploit requires network adjacency, the ease of exploitation and the role of kernel memory disclosure in enabling advanced attacks warrant timely remediation. Organizations with strong network segmentation and no exposed UPnP services can defer patching but should still plan for upgrade windows. Prioritize devices acting as gateways to high-value assets or in multi-tenant environments.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity rating. The AV:A (Adjacent Network) vector restricts the attack to local network attackers, preventing remote exploitation over the internet. AC:L (Low complexity) indicates minimal technical barriers to exploitation. PR:N and UI:N indicate no authentication or user interaction is required, making the attack immediate and passive. The C:L (Low confidentiality impact) reflects information disclosure limited to memory layout, not sensitive user data or encryption keys. The I:N (No integrity impact) and A:N (No availability impact) mean the router's function and data integrity are not directly compromised. The scope is Unchanged, confirming the impact does not propagate beyond the affected system's security domain. While the score is moderate, the vulnerability's value in reconnaissance for subsequent attacks elevates its practical importance beyond the numerical rating.

Frequently asked questions