CVE-2026-36616: Mercusys AC12G Information Disclosure

CVE-2026-36616 Overview

CVE-2026-36616 affects the Mercusys AC12G (EU) V1 wireless router running firmware version AC12G(EU)_V1_200909. The production firmware binary embeds hardcoded WiFi driver credentials, including a RADIUS shared secret, a WPS test key, and a default Pre-Shared Key (PSK). Attackers who extract the firmware image can recover these static secrets and reuse them across every deployed device of the same model and firmware version [CWE-798].

Critical Impact
Recovered hardcoded credentials enable attackers to impersonate RADIUS infrastructure, bypass WPS protections, and predict default WiFi PSKs across all affected devices.

Affected Products

Mercusys AC12G (EU) V1
Firmware AC12G(EU)_V1_200909
WiFi driver components shipped in the production firmware image

Discovery Timeline

2026-06-03 - CVE-2026-36616 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-36616

Vulnerability Analysis

The vulnerability stems from embedding sensitive WiFi driver secrets directly inside the shipped firmware binary. Static analysis of the firmware image reveals three categories of credentials: a RADIUS shared secret used for 802.1X authentication exchanges, a WPS test key intended for development scenarios, and a default PSK applied to wireless network configuration. Because the values are compiled into the firmware, every device running AC12G(EU)_V1_200909 shares the same secrets.

An attacker only needs to obtain the firmware image, which is typically available from vendor download portals or by dumping flash from a single device. Once extracted, the credentials can be reused against any other unit running the same image without device-specific interaction.

Root Cause

The root cause is the use of hardcoded credentials in production firmware. The build process retains test and default secrets that should either be generated per device at first boot or sourced from a secure provisioning channel. Storing them in the firmware binary makes them recoverable through string extraction or firmware reverse engineering.

Attack Vector

Attackers exploit the credentials in several ways. The RADIUS shared secret allows impersonation of authentication exchanges and decryption of captured RADIUS traffic on networks that use the default configuration. The WPS test key may enable bypass of Wi-Fi Protected Setup safeguards. The default PSK gives attackers an initial wireless key to test against any AC12G (EU) V1 device that has not been reconfigured by the operator. See the GitHub Advisory CVE-2026-36616 for technical details.

Detection Methods for CVE-2026-36616

Indicators of Compromise

Wireless clients associating with an AC12G (EU) V1 SSID using the default factory PSK after deployment
RADIUS traffic to or from the router authenticated with the shared secret recovered from firmware
Unexpected WPS registration attempts succeeding without administrator interaction

Detection Strategies

Inspect router configuration to confirm whether the default PSK or RADIUS shared secret has been replaced with operator-supplied values
Perform firmware string and binary analysis to confirm the presence of the embedded credentials before deployment
Capture wireless and RADIUS traffic to identify authentication using known-static secrets

Monitoring Recommendations

Alert on new or unknown client associations to networks served by AC12G (EU) V1 routers
Monitor RADIUS server logs for authentication attempts using the shared secret from non-approved network access servers
Track firmware versions across the fleet and flag any device still running AC12G(EU)_V1_200909

How to Mitigate CVE-2026-36616

Immediate Actions Required

Replace the default WiFi PSK on every AC12G (EU) V1 device with a unique, high-entropy passphrase
Rotate any RADIUS shared secret that was configured using the default value and segment authentication infrastructure from untrusted networks
Disable WPS on affected devices to remove exposure of the embedded WPS test key

Patch Information

No vendor advisory or fixed firmware version is referenced in the published CVE data. Operators should consult the GitHub Advisory CVE-2026-36616 and the Mercusys support site for updated firmware releases that remove the hardcoded credentials.

Workarounds

Place affected routers behind a separate VLAN and restrict management access to trusted administrative hosts
Replace the device with hardware that supports per-device provisioning of WiFi and RADIUS secrets if a patched firmware is unavailable
Periodically audit wireless and RADIUS configuration to confirm that no default secrets remain in use

bash

# Configuration example
# Disable WPS and set a unique PSK from the router CLI or web UI
set wireless wps disabled
set wireless security wpa2-psk passphrase '<unique-high-entropy-passphrase>'
set radius shared-secret '<rotated-shared-secret>'
commit ; save