CVE-2026-36603: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress

Synopsis

An authentication-bypass vulnerability in the Mercusys AC12G (EU) V1 router (firmware AC12G(EU)_V1_200909) exposes 15 of 18 UPnP IGD actions on port 1900 without requiring any credentials, including AddPortMapping and GetExternalIPAddress. Any unauthenticated device on the local network can reach these actions because UPnP is enabled by default through the admin interface. Successful exploitation lets an attacker create arbitrary port forwarding rules and read WAN traffic statistics, opening internal services to the internet without authorization. No upstream fix has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same local network, LAN segment, or VPN as the target router; remote exploitation over the public internet is not directly possible via this vector (AV:A).

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable UPnP IGD actions are exposed without any authentication check (PR:N).

• Victim interactionNot required

  The attacker does not need any user on the target network to take any action; exploitation is fully attacker-driven (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layout, or environmental prerequisites are required (AC:L).

Blast Radius

• An attacker reads the router's external (WAN) IP address and traffic statistics via GetExternalIPAddress and related actions, exposing network topology details.
• An attacker creates arbitrary port forwarding rules via AddPortMapping, redirecting external internet traffic to any internal host and port without authorization.
• Internal services that were never intended to be internet-facing, such as administrative interfaces or unpatched LAN services, become reachable from the public internet through attacker-defined forwarding rules.
• Persistent forwarding rules survive reboots if written to the router's configuration, meaning the exposure continues after the attacker's LAN session ends.