CVE-2026-36607 Details
Description
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.
A vulnerability exists in the Mercusys AC12G (EU) V1 router, specifically in the TDDP password change endpoint, which allows for unauthenticated brute-force attacks. This issue arises because the password change endpoint lacks the rate limiting found on the login endpoint, enabling an attacker on the adjacent network to attempt unlimited password guesses without triggering an account lockout. The vulnerability affects routers running the AC12G(EU)_V1_200909 firmware, and has been tested on this version as well as AC12G(EU)_V1_210128.
To address this vulnerability, it is recommended to apply the same rate limiting to the password change endpoint (code=10) that is currently in place on the login endpoint (code=7). Additionally, password change requests should require an active authenticated session before being processed, and account lockout mechanisms should be implemented across all endpoints that validate authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 3, 2026CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36607.md | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mercusys AC12G | AC12G(EU)_V1_200909 AC12G(EU)_V1_210128 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | New CVE Received | [email protected] |