CVE-2026-36608: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192

Synopsis

This is an access-control bypass in the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The router's UPnP service accepts AddPortMapping SOAP requests that name the router's own IP address (192.168.1.1) or localhost (127.0.0.1) as the internal forwarding target, which it should reject. An unauthenticated attacker on the local network can send a single crafted SOAP request to permanently expose the router's admin interface to the public internet, enabling full device compromise. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same local network segment (LAN, Wi-Fi, or adjacent VLAN) as the router; remote internet-based exploitation is not possible for the initial SOAP request, though success exposes the admin panel to the internet.

• AuthenticationNot required

  No credentials are needed; the UPnP AddPortMapping endpoint accepts the malicious SOAP request from any unauthenticated LAN client.

• Victim interactionNot required

  The attacker sends a single SOAP request directly to the router; no user on the target network needs to click anything or take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout knowledge, or special environmental factors are required beyond LAN access.

Blast Radius

• The attacker exposes the router's admin interface to the entire public internet by creating a persistent port-forwarding rule, removing the LAN-only access boundary.
• An internet-side attacker who reaches the newly exposed admin panel can read all router configuration including Wi-Fi credentials, VPN secrets, and connected-device tables.
• An internet-side attacker can modify routing rules, DNS settings, and firewall policies, redirecting or intercepting all traffic passing through the router.
• Full control of the router allows the attacker to disrupt connectivity for every device on the network by altering or disabling WAN or LAN configuration.