CVE-2026-36609

CVSS Score & Metrics

Base Score

7.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L                                    

Vulnerability Description

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.

Vulnerability Details

Published Date

June 03, 2026

Last Modified

June 04, 2026

CWE ID

CWE-327

Source

NVD

External References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36609.md

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment