Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.
References
Configurations
No configuration.
History
03 Jun 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-200 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.3 |
03 Jun 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-03 18:16
Updated : 2026-06-04 15:41
NVD link : CVE-2026-36611
Mitre link : CVE-2026-36611
CVE.ORG link : CVE-2026-36611
JSON object : View
Products Affected
No product.
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor