Mercusys AC12G TDDP Password Change Endpoint excessive authentication

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Mercusys AC12G. The affected element is an unknown function of the component TDDP Password Change Endpoint. Performing a manipulation results in excessive authentication. This vulnerability is reported as CVE-2026-36607. The attacker must have access to the local network to execute the attack. No exploit exists.

Detailsinfo

A vulnerability was found in Mercusys AC12G (affected version unknown). It has been classified as problematic. This affects an unknown functionality of the component TDDP Password Change Endpoint. The manipulation with an unknown input leads to a excessive authentication vulnerability. CWE is classifying the issue as CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. This is going to have an impact on confidentiality. The summary by CVE is:

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-36607 since 04/06/2026. The exploitability is told to be difficult. The attack can only be done within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34146). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Mercusys

Name

• AC12G

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion