CVE-2026-36613: Mercusys AC12G Memory Disclosure Vulnerability

Technical summary

This vulnerability stems from improper input handling in the Mercusys AC12G (EU) V1's HTTP server implementation. When the router receives POST requests directed to undefined or non-existent paths, the firmware fails to properly initialize or sanitize the response buffer before transmitting it to the client. This results in the transmission of 128 bytes of uninitialized heap or stack memory, classified under CWE-125 (Out-of-bounds Read). The exposure is limited to adjacent network attackers because the HTTP service is typically only accessible from devices connected to the same LAN or Wi-Fi network. The vulnerability is deterministic and repeatable—any unauthenticated client on the network can exploit it without special privileges or preconditions.

Business impact

For home and small business environments using the Mercusys AC12G router, this vulnerability creates a reconnaissance channel for local attackers. An adversary on the network can passively gather router state information to support further attacks, such as identifying running services, firmware versions, or memory patterns useful for crafting subsequent exploits. While the CVSS score of 4.3 reflects limited direct impact (read-only, no authentication required, but adjacency-limited), the intelligence disclosure can reduce the attacker's reconnaissance effort and increase the likelihood of a chained attack. Organizations deploying these routers in guest networks or multi-tenant environments should be particularly concerned.

Affected systems

This issue specifically affects Mercusys AC12G (EU) V1 units running firmware version AC12G(EU)_V1_200909. The Mercusys brand is TP-Link's budget sub-brand, and AC12G is a compact Wi-Fi 5 (802.11ac) router commonly deployed in small office and home office (SOHO) environments across Europe. Users should verify their exact hardware revision and firmware version via the router's admin interface. Firmware releases after the identified vulnerable version may contain a fix, but this must be confirmed through Mercusys support or advisory channels.

Exploitability

Exploitation is straightforward and requires minimal skill. An attacker with access to the router's local network can send a simple HTTP POST request to any undefined path (e.g., http://<router-ip>/nonexistent) using standard tools like curl or wget. No authentication credentials, user interaction, or special payload crafting is necessary. The main constraint is network adjacency—the attacker must be on the same Wi-Fi network, Ethernet segment, or have routing access to the device. This makes it suitable for insider threats, compromised guest devices, or adversaries who have gained initial network access. The vulnerability is not known to be exploited in the wild, and it has not been added to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Users should immediately check for and install firmware updates from Mercusys. Visit the official Mercusys support website, enter your router model and serial number, and download the latest available firmware. Firmware updates should address this memory disclosure issue. If no newer firmware is available, consider network segmentation: restrict access to the router's web interface to trusted devices only, use firewall rules to block HTTP/HTTPS access from untrusted network segments, and monitor for suspicious POST requests to undefined paths. In high-security environments, consider replacing the device with a model from a vendor with more active security support.

Patch guidance

Obtain the latest firmware release for Mercusys AC12G (EU) V1 directly from the Mercusys support portal (verify against the vendor advisory). Firmware updates can typically be applied via the router's admin web interface under System Settings or Administration > Firmware Upgrade. Before upgrading, back up your current configuration. Allow the router 5–10 minutes to complete the update without interruption. After the update completes, verify the new firmware version is displayed in the system information page. If a patch is not yet available, monitor Mercusys security advisories and subscribe to firmware release notifications.

Detection guidance

Monitor HTTP access logs on the router (if available) for POST requests to non-existent paths. Look for unusual patterns such as repeated requests to /admin, /api, /test, or other undefined endpoints. If your router supports NetFlow or syslog export, configure it to send logs to a SIEM or log aggregation tool. On a network IDS/IPS, create a rule to flag HTTP POST requests from local clients to the router's web interface followed by responses containing large amounts of null or uninitialized data. Check for signs of reconnaissance: multiple failed authentication attempts, requests to unusual URIs, or abnormally sized HTTP responses from the router's web service.

Why prioritize this

This vulnerability merits attention in SOHO and SMB environments but should be prioritized below critical or high-risk exposures. The CVSS score of 4.3 (Medium) reflects limited scope: network adjacency is required, there is no authentication bypass, and the impact is read-only information disclosure. However, it should not be ignored, as it can facilitate further reconnaissance and attacks. Prioritize patching if the router is in a multi-tenant, guest-accessible, or high-value network segment. For isolated home networks with low-risk profiles, patching is still recommended but can be scheduled as part of routine maintenance.

Risk score, explained

The CVSS:3.1 score of 4.3 is derived from Attack Vector (Adjacent), Access Complexity (Low), Privileges Required (None), User Interaction (None), Scope (Unchanged), Confidentiality (Low), Integrity (None), and Availability (None). The Medium severity reflects that the vulnerability is easily exploitable by local attackers with no privileges, but the attack surface is limited to adjacent networks, and the impact is confined to low-level information disclosure without affecting system integrity or availability. The lack of authentication requirement increases the score, but adjacency limitation prevents a higher rating.

Frequently asked questions