CVE-2026-36603

Executive Summary

CVE-2026-36603 exposes a critical authentication bypass in the Mercusys AC12G (EU) V1 router, firmware version AC12G(EU)_V1_200909. The UPnP (Universal Plug and Play) IGD (Internet Gateway Device) service on port 1900 (UDP) exposes 15 of 18 IGD actions — including AddPortMapping and GetExternalIPAddress — without any authentication. Any unauthenticated device on the local network segment can send crafted UPnP SOAP requests over UDP to create arbitrary port forwarding rules, intercept or redirect inbound traffic destined for the router's WAN interface, and retrieve WAN-side traffic statistics that may leak internal addressing and session information. With UPnP enabled by default via the administrative web interface, this vulnerability is exploitable by default on out-of-the-box devices and remains unpatched at the time of writing. Impact is assessed as High severity given the low attack complexity and adjacency-only network requirement, though direct remote exploitation requires an attacker to already be on the LAN or to chain this with a separate pre-authentication WAN-side flaw.

Technical Analysis

The Mercusys AC12G router runs a custom Linux-based firmware with a miniUPnP-derived IGD service bound to UDP port 1900. The UPnP implementation processes SOAP (Simple Object Access Protocol) requests embedded in UDP datagrams, following the UPnP Device Architecture 1.0 specification. The IGD service exposes a WANIPConnection service definition with 18 actions total. Of these, 15 actions are registered with the service control point without any authentication gate.

The affected actions include, but are not limited to:

• AddPortMapping — Creates a new port forwarding rule on the router's WAN interface.
• DeletePortMapping — Removes an existing port forwarding rule.
• GetExternalIPAddress — Returns the router's WAN-facing IP address.
• GetGenericPortMappingEntry — Enumerates all existing port mapping rules.
• GetSpecificPortMappingEntry — Retrieves a specific port mapping.
• GetTotalBytesSent / GetTotalBytesReceived — Exposes WAN traffic counters.
• GetStatusInfo — Returns connection status and uptime.
• SetConnectionType / ForceTermination — Alters WAN connection behavior.

The missing authentication is rooted in the UPnP daemon's control point dispatcher. Upon receiving a UDP datagram on port 1900, the service parses the XML action request and directly invokes the corresponding handler function. No session token, shared secret, or IP-address allowlist is checked. The router does not restrict UPnP action requests from arbitrary LAN IPs; any host that can reach UDP port 1900 on the router's LAN interface (typically 192.168.x.1) can invoke these actions.

The attack surface is primarily the LAN interface, since UDP port 1900 is bound to the internal bridge (br-lan). The WAN-facing interface typically does not listen on this port, but NAT-loopback misconfigurations or IPv6 firewall rules could expand the exposure. The GetExternalIPAddress action leaks the public IP, which is low sensitivity itself, but combined with GetGenericPortMappingEntry, an attacker can map all existing port forwards and infer which internal services are reachable from the internet.

The most severe action is AddPortMapping. An attacker can add a mapping from an arbitrary WAN port to an arbitrary LAN IP and port. This allows traffic hijacking: for example, an attacker can map WAN port 8080 to an internal host's port 80, diverting clear-text HTTP traffic to the attacker's controlled host. Alternatively, an attacker can map a WAN port to the router's own LAN IP for a sensitive internal service (e.g., port 22 for SSH or port 80 for the admin UI), enabling WAN-side reachability of previously internal-only services. Because the UPnP mapping persists in the NAT table, a single UDP packet is sufficient to create a persistent backdoor that survives a reboot in some configurations (mappings are typically re-applied after reboot if stored in NV-RAM).

Exploitation Scenarios

Scenario 1: Co-located LAN Attacker — Port Forwarding Hijack

1. Reconnaissance: The attacker connects a laptop to the target network (e.g., a coffee shop Wi-Fi, corporate guest network, or via a compromised IoT device already on the LAN). The attacker enumerates the local subnet (typically 192.168.0.0/24 or 192.168.1.0/24) and identifies the gateway MAC address. The router's gateway IP is assumed to be the default gateway from DHCP.

2. Service Fingerprint: The attacker sends a multicast SSDP discovery packet to 239.255.255.250:1900 with the query M-SEARCH * HTTP/1.1. The router responds with a 200 OK message containing its UUID and device type urn:schemas-upnp-org:device:InternetGatewayDevice:1. This confirms UPnP is enabled and the device is a Mercusys AC12G.

3. Mapping Exfiltration: The attacker sends a unicast SOAP request to the router's LAN IP on UDP port 1900, invoking GetGenericPortMappingEntry with an index of 0. The response enumerates the first existing port mapping. The attacker iterates the index (0, 1, 2...) until an empty response is returned, building a full inventory of the victim's port forwards.

4. Payload — AddPortMapping: The attacker crafts a SOAP request:

   POST /upnp/control/WANIPConnection HTTP/1.1
   HOST: 192.168.1.1:1900
   CONTENT-TYPE: text/xml; charset="utf-8"
   SOAPACTION: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"
   

   With an XML body containing:

   • NewRemoteHost: empty string (all hosts)
   • NewExternalPort: 443
   • NewProtocol: TCP
   • NewInternalPort: 4443
   • NewInternalClient:
   • NewEnabled: 1
   • NewPortMappingDescription: "test"

   The router responds with HTTP 200 and an empty AddPortMappingResponse envelope, confirming success.

5. Post-Exploitation: External attackers connecting to the victim's WAN IP on TCP port 443 will have their traffic forwarded to the attacker's internal host on port 4443. The attacker can now:

   • Intercept TLS-terminated traffic if they control the internal endpoint and have a self-signed or stolen certificate.
   • Redirect all inbound VPN connections to a malicious honeypot to harvest credentials.
   • Exfiltrate data from a compromised internal host by making it appear as an inbound connection.

Scenario 2: Inbound VPN Hijack via NAT Redirection

1. Reconnaissance: The attacker on the LAN identifies that the victim network uses a site-to-site VPN (e.g., IPSec port 500/4500). The attacker queries GetGenericPortMappingEntry and discovers an existing mapping from WAN 4500 to the internal VPN gateway at 10.10.0.5:4500.

2. Weaponization: The attacker invokes DeletePortMapping to remove the legitimate VPN mapping, then immediately invokes AddPortMapping to re-map WAN 4500 to the attacker's laptop at 10.10.0.66:4500 running a modified strongSwan instance.

3. Execution: Remote VPN clients attempt to connect to the corporate tunnel but instead reach the attacker's rogue VPN server. The attacker authenticates the clients, capturing Active Directory credentials in the process.

4. Impact: The attacker now has valid VPN credentials and can reconnect autonomously, gaining persistent remote access to the corporate network.

Scenario 3: WAN Traffic Statistics Leakage

1. Trigger: The attacker sends GetTotalBytesSent and GetTotalBytesReceived SOAP requests.

2. Data Exfiltration: The router responds with 64-bit counters of all WAN traffic. By sampling these counters at a known interval, the attacker can calculate the victim's average download/upload bandwidth, revealing whether the victim is actively streaming, downloading large files, or idle — a privacy leakage that enables surveillance of user activities.

Impact Assessment

Confidentiality Impact: High. The GetExternalIPAddress, GetGenericPortMappingEntry, and traffic counter actions leak sensitive network topology and user activity data. In a home or small office environment, this reveals which services are exposed to the internet and the volume of traffic flowing through the device.

Integrity Impact: High. AddPortMapping and DeletePortMapping allow an attacker to arbitrarily modify the NAT table, redirecting inbound traffic and enabling man-in-the-middle attacks on unencrypted protocols. For HTTP traffic, an attacker-mapped port can be used to inject malicious content or harvest credentials.

Availability Impact: High. ForceTermination action (exposed per the 15/18 affected actions) can terminate the WAN PPPoE or DHCP connection, causing an outage requiring manual reconnection. Repeated invocation can create a sustained denial-of-service condition against the network.

Scope: Changed. The CVSS scope is "Changed" because a successful exploit on the router (adjacent network) can affect resources beyond the router itself — specifically, any internal hosts targeted by the manipulated port mappings, as well as remote VPN clients or web users whose traffic is redirected.

Business Impact:

• Home/SoHo users: Privacy breach, traffic hijacking, and inability to trust the integrity of inbound remote-access sessions (RDP, VPN).
• Small businesses: Attackers who gain LAN foothold (via rogue employee, guest Wi-Fi, or compromised printer) can pivot to redirect customer-facing services or corporate VPN endpoints, leading to credential theft and data breach.
• BLAST RADIUS: All devices behind the router are affected due to NAT manipulation, even if those devices themselves have no vulnerability. The router's default UPnP-enabled state increases the prevalence of exposed deployments.

Detection Guidance

Sigma Rule

title: Mercusys AC12G UPnP Unauthenticated AddPortMapping
id: 7f3a1c9e-3d1a-4f88-9efd-2a1c3d5e8b90
status: experimental
description: Detects SOAP Action AddPortMapping targeting UDP 1900 on Mercusys AC12G routers without source authentication
logsource:
  category: firewall
  product: linux
  service: iptables
detection:
  selection:
    dst.port: 1900
    protocol: udp
    message|contains:
      - 'SOAPACTION'
      - 'AddPortMapping'
  filter:
    src.ip|startswith:
      - '192.168.1.'
      - '10.'
      - '172.16.'
  condition: selection and not filter
level: high
tags:
  - attack.t1190
  - cve.2026.36603

YARA Rule

rule CVE_2026_36603_UPnP_AddPortMapping {
   meta:
      author = "ValtersIT SOC"
      description = "Detects SOAP payload targeting Mercusys AC12G UPnP AddPortMapping"
      cve = "CVE-2026-36603"
      date = "2026-06-15"
   strings:
      // SOAP Action header for IGD WANIPConnection
      $s1 = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" ascii nocase
      // Namespace declaration indicating IGD service
      $s2 = "urn:schemas-upnp-org:device:InternetGatewayDevice:1" ascii nocase
      // NewInternalClient parameter — the target of the port forward
      $s3 = "<NewInternalClient>" ascii nocase
      $s4 = "<NewExternalPort>" ascii nocase
      $s5 = "<NewProtocol>TCP" ascii nocase
   condition:
      uint16(0) == 0x0D0A or $s1 and $s2 and 2 of ($s3, $s4, $s5)
}

Suricata IDS Rule

alert udp any any -> any 1900 (msg:"CVE-2026-36603 Mercusys AC12G UPnP AddPortMapping attempt"; content:"POST /upnp/control/WANIPConnection"; depth:35; content:"SOAPACTION"; content:"AddPortMapping"; within:100; content:"NewInternalClient"; within:150; classtype:attempted-admin; sid:1000001; rev:1; metadata:created_at 2026_06_15, updated_at 2026_06_15, cve CVE-2026-36603)

Elastic Detection

sequence by host.ip, source.ip
  [ network where network.protocol == "udp" and destination.port == 1900
    and network.transport == "udp"
    and message != null and wildcard(message, "*AddPortMapping*") ]
  [ network where network.protocol == "udp" and destination.port == 1900
    and message != null and wildcard(message, "*GetGenericPortMappingEntry*") ]

Additional detection on traffic counters:

network where network.protocol == "udp" and destination.port == 1900
  and message != null and wildcard(message, "*GetTotalBytesSent*")

Splunk SPL Query

index=firewall OR index=netflow
| where dest_port=1900 AND protocol=udp
| search "AddPortMapping" OR "DeletePortMapping" OR "GetExternalIPAddress"
| stats count by src_ip, dest_ip, _time
| where count > 5
| sort - _time

For packet capture data:

index=packetcapture
| where dest_port=1900
| regex _raw="SOAPACTION.*(AddPortMapping|DeletePortMapping|ForceTermination)"
| table _time, src_ip, dest_ip, _raw
| eval severity=case(count eq 1 "low", count >1 "medium", count >10 "high")

Wazuh OSSEC Rule

<rule id="100366" level="12">
  <if_sid>520</if_sid>
  <match>AddPortMapping</match>
  <regex>SOAPACTION.*WANIPConnection.*AddPortMapping</regex>
  <description>Mercusys AC12G UPnP unauthenticated AddPortMapping detected (CVE-2026-36603)</description>
  <group>authentication_failures,upnp,vulnerability,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>
<rule id="100367" level="10">
  <if_sid>520</if_sid>
  <match>GetExternalIPAddress</match>
  <description>Mercusys AC12G UPnP unauthenticated GetExternalIPAddress request (CVE-2026-36603 reconnaissance)</description>
  <group>recon,upnp,</group>
  <mitre>
    <id>T1595</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — No vendor fix exists as of this report. The firmware version AC12G(EU)_V1_200909 is the current confirmed affected build, and Mercusys has not published a CVE advisory, a firmware update, or a release note addressing this issue. Patch confidence is 0/4 based on monitoring of the vendor portal, NVD, and public exploit databases.

Immediate Mitigations (defense in depth — implement all):

1. Disable UPnP — Log into the router's administrative interface (typically http://192.168.1.1), navigate to Advanced Settings → Network → UPnP, and toggle the UPnP service to "Disabled." This is the single most effective immediate mitigation. Note: some applications (gaming consoles, VoIP devices, IoT hubs) rely on UPnP; after disabling, users must manually configure port forwards for those services.

2. Enable LAN-side firewall rules — If the router supports custom firewall rules, add an iptables rule:

   iptables -I INPUT -p udp --dport 1900 -j DROP
   

   This blocks all UPnP traffic at the network layer, effectively disabling the SCP even if the daemon is running.

3. Restrict LAN access — Enable the router's "AP Isolation" or "Client Isolation" feature to prevent peer-to-peer LAN communication between wireless clients, reducing the attack surface from guest Wi-Fi users or compromised IoT devices.

4. Change default credentials — Ensure the admin password is changed from default. While this does not affect UPnP (which requires no authentication), it prevents an attacker from re-enabling UPnP after it is disabled.

5. VLAN segmentation — Segment the network so IoT/guest devices are on a separate VLAN that cannot reach the router's management IP on UDP 1900.

Patch/Upgrade Steps:

• Monitor the Mercusys support page (https://www.mercusys.com/en/support/ ) for AC12G firmware updates.
• Check the firmware version via the router's web UI (System Tools → Firmware Upgrade). If a newer version is released, download the .bin file from the vendor and apply it via the web UI. Verify the MD5 checksum before flashing.
• Subscribe to the NVD CVE feed or the CISA Known Exploited Vulnerabilities catalog for CVE-2026-36603 to receive notification when a patch is published.
• If the device does not receive a patch within 90 days, consider replacing the router with a vendor that has a proven security update track record (e.g., a current TP-Link Omada or Asus RT-series device with active firmware support).

Long-Term Hardening:

• Replace the router with a model that supports UPnP authentication or a disable-by-default UPnP policy.
• Deploy a dedicated firewall (e.g., pfSense/OPNsense) in front of the router and place the Mercusys in bridge/AP mode, disabling its routing functions entirely.
• Regularly audit the NAT/port-forwarding table for unexpected entries, especially after any LAN-side incident.
• Enable logging on the router (if supported) and forward syslog to a central SIEM for continuous monitoring of UDP 1900 traffic.
• Establish a device replacement policy: end-of-life consumer routers should be replaced every 2–3 years regardless of vendor patching status.

References

1. NVD Entry — CVE-2026-36603: https://nvd.nist.gov/vuln/detail/CVE-2026-36603 (Note: NVD currently lists this CVE with incomplete data; CVSS vector provided in this report is an editorial assessment)
2. Mercusys Official Support Portal: https://www.mercusys.com/en/support/ (Track for AC12G firmware updates and security advisories)
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-36603 is NOT currently listed; monitor for updates)
4. UPnP IGD Specification (Open Connectivity Foundation): https://openconnectivity.org/developer/specifications/upnp-resources/upnp/ (Reference for the IGD WANIPConnection service definition)
5. Rapid7 UPnP Research (historical IGD vulnerabilities): https://www.rapid7.com/blog/post/2020/06/16/uncovering-upnp-vulnerabilities/ (Background on class-wide UPnP IGD misconfiguration patterns)

Threat Actor Intelligence: No known threat actor campaigns have been attributed to this CVE as of the report date. The CVE is not listed in CISA KEV and has an EPSS score of 0.00211 (11.5th percentile), indicating low exploit prevalence in the wild to date. However, the low exploit prediction score reflects limited public awareness, not technical difficulty — the vulnerability requires only a single crafted UDP datagram and is trivially exploitable given LAN access. SOC teams should treat this as a moderate-priority risk for home users and small offices, with elevated priority for businesses that host guest Wi-Fi or have numerous IoT devices on the same flat network segment.