CVE-2026-36603

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36603.md

Configurations

No configuration.

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El router Mercusys AC12G (EU) V1 con firmware AC12G(EU)_V1_200909 expone 15 de 18 acciones UPnP IGD sin autenticación en el puerto 1900, incluyendo AddPortMapping y GetExternalIPAddress. UPnP está habilitado por defecto a través de la interfaz de administración, permitiendo a cualquier dispositivo LAN no autenticado crear reglas arbitrarias de reenvío de puertos y acceder a las estadísticas de tráfico WAN.

05 Jun 2026, 02:17

Type	Values Removed	Values Added
CWE		CWE-306
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.1

03 Jun 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-03 18:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-36603

Mitre link : CVE-2026-36603

CVE.ORG link : CVE-2026-36603

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-36603", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-36603", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-05T02:03:49.673529Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-06-03T18:16:21.290", "references": [{"url": "https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36603.md", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics."}, {"lang": "es", "value": "El router Mercusys AC12G (EU) V1 con firmware AC12G(EU)_V1_200909 expone 15 de 18 acciones UPnP IGD sin autenticaci\u00f3n en el puerto 1900, incluyendo AddPortMapping y GetExternalIPAddress. UPnP est\u00e1 habilitado por defecto a trav\u00e9s de la interfaz de administraci\u00f3n, permitiendo a cualquier dispositivo LAN no autenticado crear reglas arbitrarias de reenv\u00edo de puertos y acceder a las estad\u00edsticas de tr\u00e1fico WAN."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "cve@mitre.org"}