CVE-2026-36609: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP

Synopsis

An authentication-bypass vulnerability affects the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The router issues a static authentication nonce that never rotates between requests from the same source IP, and its password encoding relies on a predictable XOR-based function (securityEncode). A remote, unauthenticated attacker who can capture authentication traffic can reverse-engineer the encoded token to recover the plaintext admin password. No fix version has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's web interface over the network; the vulnerability is exposed to anyone who can send HTTP requests to the affected device.

• AuthenticationNot required

  No credentials are needed; the attacker captures unauthenticated authentication traffic and decodes it without logging in.

• Victim interactionNot required

  No victim action is required; the attacker passively captures a login exchange or replays requests without any user involvement.

• Attack complexityDetail

  Attack complexity is low; the XOR decoding and static nonce extraction are deterministic operations with no race conditions or environmental prerequisites.

Blast Radius

• Attacker recovers the plaintext administrator password for the router, gaining full administrative access to the device.
• With admin access, the attacker can read network configuration, connected-client lists, DNS settings, and any credentials stored in the router interface.
• The attacker can modify routing rules, DNS entries, or firewall settings, redirecting or intercepting traffic for all clients on the network.
• The attacker can reboot the router, change the admin password to lock out legitimate users, or flash alternative firmware, disrupting network availability.