VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 3, 2026

CVE-2026-36603

CVE-2026-36603

Description

Mercusys AC12G routers allow unauthenticated LAN devices to create port forwarding rules and access network info via UPnP.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Mercusys AC12G routers allow unauthenticated LAN devices to create port forwarding rules and access network info via UPnP.

Vulnerability

The Mercusys AC12G (EU) V1 router, specifically firmware versions AC12G(EU)_V1_200909 and AC12G(EU)_V1_210128, exposes 15 of 18 UPnP IGD SOAP actions without authentication on port 1900. UPnP is enabled by default and cannot be disabled via the admin interface.

Exploitation

Any unauthenticated device on the local area network (LAN) can interact with the UPnP IGD service. An attacker can leverage this by sending unauthenticated requests to port 1900 to execute actions such as AddPortMapping, DeletePortMapping, ForceTermination, and GetExternalIPAddress.

Impact

Successful exploitation allows any LAN device to create arbitrary port forwarding rules, potentially exposing internal services to the WAN. Attackers can also disconnect the WAN connection, access sensitive network information like the WAN IP address, and monitor traffic statistics. This vulnerability is a prerequisite for other related attacks [1].

Mitigation

According to the provided reference, the affected products are end-of-life, and no fix is planned. There are no workarounds mentioned in the available references. The product is not listed as part of the CISA KEV catalog [1].

References
  1. MERCUSYS-AC12G/advisories/CVE-2026-36603.md at master · Tymbark7372/MERCUSYS-AC12G

AI Insight generated on Jun 3, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

1

News mentions

1