CVE-2026-78860 in AC12
Summary
by MITRE • 10/06/2026
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the Mercusys AC12 V2 wireless router represents a critical security flaw stemming from inadequate data protection mechanisms, specifically classified under CWE-319 as Cleartext Transmission of Sensitive Information. This issue allows for local code execution by exploiting the device's failure to encrypt sensitive configuration data or credentials when stored on its internal storage media. In typical embedded systems like consumer-grade routers, administrative passwords and network keys are often written to non-volatile memory such as flash storage in a readable format rather than being hashed or encrypted using robust cryptographic standards. This architectural oversight creates a direct pathway for an attacker with physical access or local network connectivity to extract these plaintext values, which can then be leveraged to gain unauthorized control over the device's firmware and underlying operating system components.
From a technical perspective, the flaw resides in how the router’s management interface handles persistent data storage. When administrators configure settings such as Wi-Fi passwords, WPA keys, or administrative login credentials, the embedded web server or configuration daemon writes these strings directly to disk without applying any obfuscation or encryption layer. This means that anyone who can access the file system of the device, either through a local network connection exploiting other minor misconfigurations or via physical extraction of the storage chip, can read these sensitive fields in their original form. The presence of plaintext credentials significantly lowers the barrier for privilege escalation attacks, as attackers do not need to perform complex reverse engineering or brute-force cracking to obtain valid authentication tokens. Instead, they can simply parse configuration files to harvest secrets that grant full administrative privileges.
The operational impact of this vulnerability is severe, particularly in environments where physical security cannot be guaranteed or when devices are deployed on untrusted local networks. An attacker who exploits this flaw can achieve arbitrary code execution by manipulating the extracted credentials to access privileged system commands or by injecting malicious scripts into configuration files that are executed during device startup or management interface interactions. This aligns with MITRE ATT&CK techniques related to Credential Access and Defense Evasion, as the plaintext storage facilitates lateral movement within a network once initial foothold is gained. Furthermore, because routers often serve as gateways between internal private networks and external public internet traffic, compromising this single device can lead to broader network compromise, including interception of unencrypted web traffic, DNS spoofing, or complete denial of service through firmware corruption.
Mitigation strategies for this vulnerability must focus on both immediate remediation and long-term architectural improvements. Users should immediately update the router’s firmware if a patch is available from Mercusys that addresses this specific storage issue by implementing proper encryption or hashing mechanisms for sensitive data fields. In cases where updates are not yet released, administrators can mitigate risk by changing default passwords to strong, complex passphrases and disabling remote management features to reduce exposure to local network attackers. Additionally, placing the router in a DMZ segment with strict firewall rules limiting access to only necessary ports can help contain potential exploitation attempts until a permanent fix is deployed. Manufacturers must also adhere to secure coding standards that mandate encryption of all sensitive data at rest, ensuring compliance with industry best practices for embedded device security and preventing future instances of plaintext credential storage.