CVE-2026-36607: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7)

Synopsis

This is a missing rate-limit vulnerability in the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The TDDP password-change endpoint (code=10) accepts unlimited unauthenticated password attempts over the local network or LAN segment, bypassing the lockout protection that guards the normal login endpoint (code=7). A successful brute-force attack gives the attacker full control over the router, including the ability to read, modify, or disrupt all traffic passing through it. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network, LAN segment, or connected via VPN; remote internet-based exploitation is not possible with this vector (AV:A).

• AuthenticationNot required

  No credentials are needed to target the TDDP password-change endpoint; the attack proceeds entirely unauthenticated (PR:N).

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator on the targeted device (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free once the attacker is on the adjacent network; no race conditions or special environmental factors apply (AC:L).

Blast Radius

• Reads the device administrator password by brute-forcing the TDDP endpoint, gaining full credential access.
• Modifies router configuration including DNS settings, firewall rules, and port forwarding, allowing traffic interception or redirection.
• Crashes or reboots the router by applying hostile configuration changes, disrupting network connectivity for all devices on the segment.
• Takes persistent administrative control of the router, enabling ongoing surveillance of unencrypted traffic traversing the device.