CVE-2026-36607: Mercusys AC12G Authentication Bypass Flaw

CVE-2026-36607 Overview

CVE-2026-36607 affects the Mercusys AC12G (EU) V1 wireless router running firmware AC12G(EU)_V1_200909. The TP-Link Device Debug Protocol (TDDP) password change endpoint (code=10) lacks rate limiting and account lockout controls. The login endpoint (code=7) enforces these protections, but the password change handler does not. An attacker on the adjacent network can issue unlimited authentication attempts to recover the administrative password. This weakness is classified under [CWE-307]: Improper Restriction of Excessive Authentication Attempts.

Critical Impact
Unauthenticated attackers on the adjacent network can brute-force the router administrator password without triggering lockout, leading to full device compromise.

Affected Products

Mercusys AC12G (EU) V1
Firmware version AC12G(EU)_V1_200909
TDDP service exposed on the local/adjacent network

Discovery Timeline

2026-06-03 - CVE-2026-36607 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-36607

Vulnerability Analysis

The Mercusys AC12G router exposes the TP-Link Device Debug Protocol (TDDP) for configuration and management. TDDP requests are dispatched by a numeric code field that selects the action handler. The login handler (code=7) enforces authentication throttling and lockout after repeated failures. The password change handler (code=10) accepts authentication material but does not share the same throttling logic. The result is an asymmetric control surface where the brute-force protection on one endpoint can be bypassed by targeting a parallel handler that validates the same credential material.

Root Cause

The root cause is missing rate limiting on the TDDP code=10 password change endpoint. The developer applied the lockout control to code=7 but did not extend it to other handlers that perform credential validation. This is a classic [CWE-307] omission, where security controls are not consistently applied across all authentication code paths handling the same secret.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reside on the same Layer 2 segment or Wi-Fi network as the router. The attacker repeatedly issues TDDP requests with code=10 and iterates candidate passwords. Because the endpoint does not increment a failure counter or enforce a backoff, the attacker can submit credentials at line speed. Once the password is recovered, the attacker gains administrative control of the router, which enables traffic interception, DNS manipulation, firmware tampering, and pivoting into connected networks.

The vulnerability is described in prose only; no verified proof-of-concept code is published. Refer to the GitHub Security Advisory for the original technical writeup.

Detection Methods for CVE-2026-36607

Indicators of Compromise

High-frequency TDDP traffic to UDP port 1040 from a single adjacent host
Repeated requests carrying the TDDP opcode code=10 against the router management interface
Unexpected administrator password changes or session creation following a burst of TDDP traffic
New or modified DNS, DHCP, or port-forwarding configuration on the router

Detection Strategies

Capture LAN-side traffic and alert on volumetric TDDP requests targeting the router IP
Baseline normal management traffic so non-administrative hosts issuing TDDP code=10 requests are flagged
Correlate router syslog events for configuration changes with preceding TDDP activity from the same source

Monitoring Recommendations

Forward router logs and adjacent-network packet metadata to a centralized SIEM or data lake for retention
Monitor for client devices generating outbound scans or credential-spraying patterns against the gateway
Track firmware version and configuration drift on the AC12G to identify post-compromise tampering

How to Mitigate CVE-2026-36607

Immediate Actions Required

Restrict physical and wireless access to the router by disabling open or weakly secured Wi-Fi networks
Place the router management interface on an isolated VLAN that only trusted administrative hosts can reach
Replace the default and any previously configured administrator password with a long, high-entropy value
Audit router configuration, DNS settings, and connected client list for signs of unauthorized changes

Patch Information

No vendor patch is referenced in the published advisory at the time of NVD publication. Monitor the GitHub Security Advisory and Mercusys support channels for firmware updates addressing the TDDP rate-limiting gap.

Workarounds

Disable remote management and any non-essential TDDP services if the firmware allows it
Segment the router from untrusted devices and IoT endpoints using a separate SSID or VLAN
Use long, unique administrator credentials to maximize the search space against brute-force attempts
Consider replacing the device with a model that receives active security maintenance if no patch is released

bash

# Example: isolate router management to a trusted admin subnet using iptables on an upstream gateway
iptables -A FORWARD -p udp --dport 1040 -s 192.168.10.0/24 -d 192.168.0.1 -j ACCEPT
iptables -A FORWARD -p udp --dport 1040 -d 192.168.0.1 -j DROP