cvedb.io
CVE-2026-36606
HIGH · CVSS 7.1
EPSS exploitation probability: 0%
Published 2026-06-03T18:16:21.677 · Last modified 2026-06-17T10:41:09.610

Summary

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.

Does this affect you?

Add your gear to cvedb and we'll alert you only when a vendor you run ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.