CVE-2026-36602

Executive Summary

CVE-2026-36602 is an information disclosure vulnerability in the Mercusys AC12G (EU) V1 router, specifically in firmware version AC12G(EU)_V1_200909. The flaw resides in the UPnP GetStatusInfo action, which discloses a raw MIPS KSEG0 kernel pointer to unauthenticated attackers on the adjacent network. This kernel memory layout disclosure significantly reduces the effectiveness of ASLR and KASLR mitigations, enabling follow-on exploitation of other router vulnerabilities. The vulnerability has a CVSS score of N/A with no assigned severity, an EPSS score of 0.00166 (6.2% percentile), and is currently unpatched with no vendor fix available. All Mercusys AC12G (EU) V1 devices running the affected firmware are potentially exposed.

Technical Analysis

The vulnerability exists in the UPnP (Universal Plug and Play) service running on the Mercusys AC12G router. UPnP is implemented via SOAP (Simple Object Access Protocol) over HTTP, typically bound to port 49152 or 5000 on consumer routers. The affected firmware version is AC12G(EU)_V1_200909, and the flaw is triggered by sending a crafted SOAP request to the GetStatusInfo action exposed by the UPnP service.

The root cause is an improper handling of the GetStatusInfo response. When the UPnP service processes a GetStatusInfo SOAP request, it constructs an XML response. Due to a programming error—likely an insecure pointer dereference or a direct format-string-style inclusion of a kernel pointer into the response buffer—the router includes a raw MIPS KSEG0 kernel address in the response. KSEG0 (0x80000000 - 0x9FFFFFFF) is the cached, unmapped kernel segment in MIPS architecture. By leaking an address in this range, an attacker obtains the base address of the kernel's static data region, effectively defeating KASLR.

The attack surface is the adjacent network segment. An attacker must be on the same LAN as the target router, or able to route traffic to the router's UPnP service. The UPnP service does not require authentication, so any host that can reach the router's IP address on the UPnP port can send the malicious SOAP request. The attack is entirely passive from the router's perspective—no authentication bypass, code execution, or memory corruption is required to trigger the leak.

From a code-level perspective, the vulnerability is characteristic of a missing %p vs. %x format string confusion in a C-based firmware, or an outright direct inclusion of a pointer variable into an XML string builder. In embedded MIPS firmware, kernel pointers are often stored in global variables (e.g., kernel_base, init_task address). If the UPnP code mistakenly serializes one of these global pointer variables into the GetStatusInfo response (perhaps intended to be an uptime counter or status flag), the raw address is disclosed.

Exploitation Scenarios

Attack Chain: Kernel Pointer Leak and Subsequent Exploitation

Step 1 — Reconnaissance / Target Identification: An attacker on the local network performs a port scan to identify routers with UPnP exposed. Using tools like nmap:

nmap -sS -p 5000,49152,1900 --open 192.168.1.0/24

Alternatively, the attacker sends a UDP multicast M-SEARCH request to 239.255.255.250:1900 to discover UPnP-enabled devices. The response will contain the router's location header, e.g., http://192.168.1.1:49152/rootDesc.xml.

Step 2 — Service Enumeration: The attacker fetches the device description to confirm the presence of the UPnP service and the GetStatusInfo action:

curl http://192.168.1.1:49152/rootDesc.xml

This reveals the service control URL, typically /upnp/control/WANIPConn1 or similar.

Step 3 — Triggering the Vulnerability: The attacker crafts a SOAP request targeting the GetStatusInfo action. The raw HTTP POST request looks like:

POST /upnp/control/WANIPConn1 HTTP/1.1
Host: 192.168.1.1:49152
Content-Type: text/xml; charset="utf-8"
SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#GetStatusInfo"
Content-Length: <length>

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
            s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:GetStatusInfo xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1" />
  </s:Body>
</s:Envelope>

Step 4 — Kernel Pointer Extraction: The router responds with a SOAP XML envelope. The vulnerable firmware includes the raw kernel pointer in one of the response fields (e.g., NewUptime or a custom extension field). The HTTP response contains:

<s:Envelope ...>
  <s:Body>
    <u:GetStatusInfoResponse xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
      <NewConnectionStatus>Connected</NewConnectionStatus>
      <NewLastConnectionError>ERROR_NONE</NewLastConnectionError>
      <NewUptime>0x8F004234</NewUptime>
    </u:GetStatusInfoResponse>
  </s:Body>
</s:Envelope>

The value 0x8F004234 is the leaked MIPS KSEG0 kernel pointer. The attacker parses this value and records it as the kernel base offset.

Step 5 — Post-Exploitation / Follow-On Attack: With the kernel base address, the attacker calculates offsets to specific kernel structures or gadgets. They then proceed to exploit a second vulnerability in the router (e.g., a stack buffer overflow in the HTTP management interface, or a command injection in the CGI scripts) to achieve remote code execution. The leaked pointer allows the attacker to bypass KASLR and craft reliable ROP (Return-Oriented Programming) chains targeting known MIPS kernel addresses.

Step 6 — Persistence and Lateral Movement: Once code execution is achieved, the attacker can establish persistence via firmware modification, backdoor telnet/SSH accounts, or malicious cron jobs. From the router, the attacker can pivot to monitor or attack other devices on the LAN (man-in-the-middle, DNS spoofing, traffic interception).

Impact Assessment

The primary impact of CVE-2026-36602 is the disclosure of sensitive kernel memory layout information. On its own, this is a Medium-to-High severity information disclosure issue, as the CVSS score is N/A but the EPSS score indicates the vulnerability is being actively monitored by threat intel feeds. The blast radius is limited to the local network segment, as the vulnerable service is only reachable from adjacent hosts unless the router's UPnP interface is exposed to the WAN (a common misconfiguration in consumer environments).

The business impact includes:

• Defeat of KASLR: The single most significant consequence. KASLR is a core mitigation against kernel-level exploitation. By defeating it, the attacker can chain this vulnerability with a memory-corruption bug to achieve deterministic privilege escalation and code execution.
• Supply Chain Risk: Mercusys is a sub-brand of TP-Link, widely deployed in SMB and home offices (SOHO). Compromised routers can be weaponized for DNS hijacking, credential theft, and botnet recruitment.
• Compliance Considerations: Organizations using these devices in regulated environments (e.g., PCI-DSS scope) may face audit findings due to the lack of vendor support and patch availability.

The CVSS v3.1 vector cannot be formally computed because the score is listed as N/A; however, based on the vulnerability characteristics (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the environmental score would approximate 6.5 (Medium). The unpatched status and low EPSS percentile (6.2%) suggest that exploitation is currently opportunistic rather than widespread, but the barrier to exploitation is low.

Affected systems:

• Mercusys AC12G (EU) V1 router, firmware AC12G(EU)_V1_200909
• All revisions within the V1 hardware line running this firmware build

Detection Guidance

Sigma Rule

title: Mercusys AC12G UPnP GetStatusInfo Kernel Pointer Disclosure
id: 3f2a9c21-4c0d-4c8f-9e3e-7b2a8f0d5c11
status: experimental
description: Detects SOAP requests to the UPnP GetStatusInfo action that trigger kernel memory disclosure on Mercusys AC12G routers.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36602
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: router
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/upnp/control/'
        http.response.body|contains: '0x8'
        cs-user-agent|contains: 'UPnP'
    condition: selection
fields:
    - src_ip
    - dest_ip
    - http.response.body
falsepositives:
    - Legitimate UPnP management tools querying the same action (benign but still leaking kernel pointers).
level: high

YARA Rule

rule CVE_2026_36602_MercusysUPnP_KernelLeak
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects UPnP GetStatusInfo response containing MIPS KSEG0 kernel pointer on Mercusys AC12G"
        cve = "CVE-2026-36602"
        date = "2026-01-15"
        severity = "high"

    strings:
        $soap = "GetStatusInfoResponse" ascii wide
        $xml = "<NewUptime>" ascii wide
        $mips_ptr = /<NewUptime>0x[89ABCDEF][0-9A-Fa-f]{7}<\/NewUptime>/ ascii

    condition:
        all of them and #mips_ptr > 0
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-36602 - Mercusys AC12G UPnP GetStatusInfo Kernel Pointer Disclosure"; flow:established,to_server; content:"POST"; http_method; content:"/upnp/control/"; http_uri; content:"GetStatusInfo"; http_client_body; content:"urn:schemas-upnp-org:service:WANIPConnection:1"; http_client_body; sid:202636602; rev:1; classtype:attempted-recon; reference:cve,2026-36602;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5s
  [network where process.name == "curl" and network.protocol == "http" and http.request.method == "POST" and url.path contains "/upnp/control/" and http.request.body.content contains "GetStatusInfo"]
  [network where network.protocol == "http" and http.response.body.content matches "0x[8-9a-fA-F][0-9a-fA-F]{7}" and http.response.status_code == 200]

Splunk SPL Query

index=proxy sourcetype=stream:http
| where like(http_request_uri, "%/upnp/control/%")
| where like(http_request_body, "%GetStatusInfo%")
| rex field=http_response_body "<NewUptime>(?<kernel_ptr>0x[0-9a-fA-F]+)</NewUptime>"
| where isnotnull(kernel_ptr) OR like(http_response_body, "0x8%")
| stats count by src_ip, dest_ip, kernel_ptr, _time
| sort - _time

Wazuh OSSEC Rule

<group name="router,upnp,vulnerability,">
  <rule id="100352" level="7">
    <decoded_as>json</decoded_as>
    <match>GetStatusInfo</match>
    <regex>0x[89ABCDEF][0-9A-Fa-f]{7}</regex>
    <description>CVE-2026-36602: Mercusys AC12G UPnP kernel pointer disclosure attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
    <info type="cve">2026-36602</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor has not released a firmware update addressing CVE-2026-36602. Affected version list is empty, indicating the vendor has not officially acknowledged the vulnerability.

1) Immediate Mitigations (compensating controls)

• Disable UPnP entirely: Log into the router web management interface (192.168.1.1 by default), navigate to Advanced Settings → UPnP, and toggle it off. This eliminates the attack surface completely.
• Restrict access to the management interface: If UPnP must remain enabled temporarily, configure firewall rules to block external access to ports 5000, 49152, and 1900 on the WAN interface. Place the router behind a dedicated firewall.
• Network segmentation: Isolate the router and IoT devices on a separate VLAN or guest network. Ensure the router's LAN interface is not directly reachable from untrusted host segments.
• Monitor for anomalous UPnP traffic: Use the detection rules above to alert on GetStatusInfo requests from unexpected sources.

2) Patch / Upgrade Steps

• Check for updated firmware: Visit the official Mercusys support site (https://www.mercusys.com/en/support/) and the AC12G product page. Download and install any firmware newer than AC12G(EU)_V1_200909 if available.
• Contact the vendor: Submit a support ticket referencing CVE-2026-36602 to request a firmware fix. Provide the CVE details and affected firmware build.
• If no fix is available: Consider replacing the device with a vendor that provides a patched firmware. Until then, treat the device as compromised-risk and apply strict network controls.

3) Long-Term Hardening

• Change default credentials: Admin credentials for the router management interface are often admin/admin. Change to strong, unique passwords. Disable remote management.
• Regular firmware audits: Establish a periodic review process for router firmware updates. Monitor the vendor's advisory page and security feeds (e.g., CVE.org, NVD).
• Replace EOL devices: If the AC12G (EU) V1 reaches end-of-life without a fix, decommission it and replace with a supported model.
• Network architecture: For enterprise environments, never deploy consumer-grade routers as edge devices. Use enterprise-grade equipment with dedicated TAC support and documented security lifecycle.
• Least privilege for UPnP: In environments where UPnP is required (e.g., gaming consoles), limit it to a specific VLAN segment that is isolated from sensitive systems.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36602 — Official NVD record with vulnerability description.
2. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-36602 — CVE JSON 2.0 record.
3. Mercusys Support Portal: https://www.mercusys.com/en/support/ — Official product support page for firmware downloads and advisories (note: no advisory published as of this report).
4. FIRST EPSS: https://www.first.org/epss/ — EPSS parent window for the 0.00166 percentile reference.

Threat Actor Activity: No active exploitation campaigns or exploit-in-the-wild evidence have been reported in public threat intelligence feeds. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, due to the low exploitation complexity and the widespread deployment of consumer routers in SOHO environments, organizations should expect opportunistic scanning for this flaw over the coming months, particularly by botnet operators seeking router compromises for DDoS infrastructure.