CVE-2026-36612 Details

A vulnerability exists in the Mercusys AC12G (EU) V1 router, specifically in the firmware version AC12G(EU)_V1_200909. The router enables Wi-Fi Protected Setup (WPS) 2.0 by default, but with a weak lockout policy that allows for repeated PIN guessing attacks. After 10 failed attempts, the router only locks out further attempts for 60 seconds. This weak policy can be exploited if WPS PIN mode is activated, allowing an attacker to recover Wi-Fi credentials in a single attempt using a predicted PIN derived from the router's BSSID MAC address.

To address this vulnerability, WPS should be disabled by default, the lockout duration should be increased to at least 3600 seconds, the maximum number of attempts before lockout should be reduced to 3, and a hardware random number generator should be used for PIN generation instead of an algorithm based on the MAC address.