CVE-2026-36611: Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers

Synopsis

An information disclosure vulnerability affects the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. When the device's UPnP service on port 1900 receives a POST request without a SOAPAction header, it returns 128 bytes of uninitialized memory to the requester, no authentication required. Successful exploitation leaks internal memory contents to any attacker who can send a crafted HTTP POST to the UPnP port, which may expose sensitive runtime data such as addresses, keys, or other in-memory values. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's UPnP service on port 1900 over the network; exposure increases significantly if this port is accessible from untrusted network segments.

• AuthenticationNot required

  No credentials or session token are needed; any unauthenticated party that can send a POST request to port 1900 can trigger the memory disclosure.

• Victim interactionNot required

  No user or administrator action is required; the vulnerable response is returned automatically by the UPnP service upon receiving a malformed POST request.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout beyond sending a single crafted POST request.

Blast Radius

• The attacker reads 128 bytes of uninitialized heap or stack memory, which may contain fragments of runtime data such as memory addresses, session identifiers, or cryptographic material.
• Partial memory address exposure can assist an attacker in bypassing address-space layout randomization if further exploitation of the device is attempted.
• Data integrity is partially at risk (CVSS I:L), meaning the attacker gains a foothold that may allow limited modification of device state or behavior.
• Service availability is partially affected (CVSS A:L), with the possibility of minor disruption to UPnP-dependent functionality on the device.