CVE-2026-36606: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode

Synopsis

A cryptographic weakness in the Mercusys AC12G (EU) V1 router (firmware AC12G(EU)_V1_200909) allows configuration backup files to be trivially decrypted. The firmware encrypts backups using a hardcoded DES key in ECB mode, both of which are well-known weak choices, and exploitation requires only local access with a low-privilege account rather than network exposure. A successful attacker who obtains a backup file recovers all stored credentials, including the admin password, WiFi pre-shared key, and DDNS credentials. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the router's network interface is required to exploit this weakness.

• AuthenticationRequired

  A low-privilege account on the device or host is sufficient; no administrator rights are needed to obtain a backup file.

• Victim interactionNot required

  No user interaction is required; the attacker can act entirely on their own once they have a session.

• Attack complexityDetail

  The exploit is reliable and condition-free: the DES key is hardcoded and the ECB mode cipher requires no knowledge of environmental state to apply.

Blast Radius

• Attacker decrypts the configuration backup and reads the router admin password in plaintext.
• Attacker recovers the WiFi pre-shared key, enabling unauthorized network access.
• Attacker obtains stored DDNS credentials, which may be reused across other services.
• Confidentiality and integrity of all credentials stored in the backup are fully compromised; no availability impact is introduced by this attack alone.