CVE-2026-78862 in AC12
Summary
by MITRE • 10/06/2026
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Mercusys AC12 V2 router represents a critical security failure rooted in improper hardware-level access control mechanisms. Specifically, this flaw permits an attacker with physical proximity to the device's internal components to execute arbitrary code through the Universal Asynchronous Receiver-Transmitter UART serial interface located on the printed circuit board. This type of vulnerability is particularly severe because it bypasses all network-based defenses such as firewalls and intrusion detection systems, relying instead on direct physical access to the hardware. The presence of exposed or poorly secured debug interfaces like UART indicates a fundamental oversight in the device's secure boot process and firmware integrity verification during both manufacturing and runtime operations.
From a technical perspective, the UART interface is typically used by developers for debugging purposes during the product development lifecycle. However, when these pins remain accessible on production units without adequate physical protection or logical authentication mechanisms, they become an attractive attack vector. An attacker can connect to these exposed headers using standard serial-to-USB adapters and terminal emulation software. By interacting with the bootloader or operating system console provided through this interface, a local attacker can gain root-level privileges. This access allows for the execution of arbitrary commands, modification of firmware partitions, extraction of sensitive credentials stored in memory or configuration files, and potentially persistent backdoors that survive factory resets if the flash memory is directly manipulated.
The operational impact of this vulnerability extends beyond immediate code execution to encompass a complete compromise of device confidentiality, integrity, and availability. Once an attacker gains control via UART, they can intercept network traffic passing through the router, effectively enabling man-in-the-middle attacks against all devices connected to the local area network. Furthermore, the compromised device can be turned into part of a botnet or used as a pivot point for lateral movement within internal networks. The ability to modify firmware means that updates intended to patch other vulnerabilities could themselves be tampered with before installation, creating a cycle of persistent compromise. This level of access undermines trust in IoT devices and poses significant risks to home users who may lack the technical expertise to detect such deep-level intrusions.
This vulnerability aligns closely with CWE-250, which describes execution with unnecessary privileges, as well as CWE-319 regarding cleartext transmission of sensitive information if credentials are exposed during boot processes accessible via UART. In terms of offensive security frameworks, this attack path corresponds to the ATT&CK technique T1647, known as Privilege Escalation from Physical Access. It also relates to T1508, which involves exploiting firmware vulnerabilities or interfaces that lack proper authentication controls. The root cause often falls under CWE-293, using default passwords for maintenance accounts, although in this specific hardware context, it is more accurately categorized under insufficient physical security measures and improper configuration of debug interfaces.
Mitigation strategies for this class of vulnerability require a multi-layered approach involving both hardware design changes and software hardening practices. Manufacturers must physically obscure or seal UART headers on production units to prevent easy access by unauthorized individuals. From a firmware perspective, it is essential to disable all non-essential serial console outputs during normal operation and implement strong authentication mechanisms for any remaining debug interfaces that cannot be physically removed. Additionally, enabling secure boot processes ensures that only signed and verified code can execute at the lowest levels of the system stack. For end-users, while physical security remains their primary defense against this specific flaw, keeping firmware updated to versions where such interfaces are disabled or secured is crucial. Network segmentation further limits the blast radius if a device is compromised via hardware access, preventing attackers from leveraging the router as a gateway into broader corporate or residential networks.