CVE-2026-36606

Executive Summary

CVE-2026-36606 is a cryptographic credential exposure vulnerability in the Mercusys AC12G (EU) V1 wireless router. The device encrypts configuration backups using single DES in ECB mode with a hardcoded, non-changing key, allowing any attacker who obtains a backup file (e.g., via stolen device, network interception of a backup transfer, or an unprotected backup file left on a local drive) to trivially decrypt it and extract all stored credentials — including the router admin password, WiFi PSK, and DDNS credentials. With an EPSS score of 0.00104 (1.2% percentile), active exploitation is currently unlikely, but the weakness is trivial to weaponize and should be treated as a high-risk credential-hygiene issue for affected deployments.

Technical Analysis

The vulnerability resides in the firmware backup/restore mechanism of the Mercusys AC12G router (firmware version AC12G(EU)_V1_200909 and earlier). When an administrator exports a configuration backup, the router serializes the full configuration state — including plaintext credentials — and encrypts it using the Data Encryption Standard (DES) in Electronic Codebook (ECB) mode with a hardcoded 8-byte key compiled into the firmware binary.

Vulnerability Mechanism

1. Hardcoded Key (CWE-321 / CWE-798): The DES key is embedded within the firmware image. Attackers who obtain the firmware (freely downloadable from the vendor's support site) can extract the key through simple binary string analysis or by emulating the encryption routine.

2. Weak Encryption Algorithm (CWE-327): Single DES has a 56-bit effective key length. Even in absence of the hardcoded key, a DES key can be brute-forced in hours using modern GPUs or cloud-based cracking services. Combined with knowledge of known plaintext (router models often have predictable configuration structures), exhaustive key search is trivially feasible.

3. ECB Mode Vulnerability: ECB mode encrypts identical plaintext blocks into identical ciphertext blocks. Configuration backups contain highly repetitive structures (e.g., repeated XML/JSON tags, default values, repeated credential fields), which leak structural information and enable pattern-matching attacks even without key extraction.

Attack Surface

• Local Attack Vector: An attacker with access to a backup file (e.g., exfiltrated from a compromised administrator workstation, found on an unsecured file share, or copied from a USB stick) can decrypt it offline.
• Network Interception: If an administrator transfers the backup over insecure channels (FTP, HTTP, or unencrypted email), a network-positioned attacker can capture it.
• Physical Access: An attacker with brief physical access to the router's management interface can trigger a backup export and exfiltrate the file.

The vulnerability does not require authentication to exploit once the backup file is obtained — decryption is a fully offline operation that requires only the hardcoded key and standard DES decryption logic.

Exploitation Scenarios

Scenario 1: Attack via Compromised Administrator Workstation

1. Reconnaissance: The attacker compromises an administrator's PC via phishing or drive-by download. During reconnaissance, they identify a Mercusys AC12G configuration backup file (typically named config.bin or backup.dat) in the user's Downloads folder, Desktop, or on a network share.

2. Extraction of Encryption Key: Using publicly available firmware of the same version, the attacker downloads the firmware image and extracts the hardcoded DES key. This requires using binwalk to extract the squashfs filesystem, locating the backup management binary (e.g., backup_restore), and using strings or Ghidra to locate the 8-byte key constant.

3. Decryption of Backup: The attacker uses a Python script (using pycryptodome) to perform DES-ECB decryption of the backup file with the extracted key. The decrypted output is a structured configuration file containing plaintext values for:

   • Administrative web-interface password (often in MD5 or SHA-1 hash — crackable offline)
   • WiFi SSID and WPA2-PSK passphrase
   • DDNS service credentials (username/password)
   • Any port-forwarding rules that reveal internal network topology

4. Post-Exploitation: The attacker:

   • Cracks the admin password hash with hashcat (mode 0 or 100) using a wordlist
   • Connects to the router's WAN-side interface (if exposed) or joins the WiFi network using the recovered PSK
   • Modifies DNS settings to redirect traffic to attacker-controlled name servers, enabling phishing or malware distribution
   • Gains lateral movement into the internal network via the WiFi PSK

Scenario 2: Network Interception of Backup Transfer

1. Reconnaissance: The attacker runs a passive network sniffer (e.g., Wireshark) on a network segment where a network administrator managing the AC12G operates.
2. Trigger: The administrator exports a backup and uploads it to a TFTP/FTP server without encryption. The attacker captures the file in transit.
3. Weaponization: The attacker decrypts the backup offline as described above, recovering the WiFi PSK. They then use the PSK to join the network and attack other hosts from within the perimeter.

Scenario 3: Physical Access to Router

1. Trigger: An attacker with brief physical access (e.g., an insider, a contracted technician) connects to the router's LAN port, navigates to the admin interface (192.168.1.1), and initiates a configuration backup using default credentials (often admin/admin).
2. Exfiltration: The backup file is downloaded to a USB drive or emailed out.
3. Exploitation: Decryption yields all credentials; the attacker can now remotely access the router and pivot into the network at any time.

Impact Assessment

CVSS Context: While no official CVSS score was assigned, a reasonable assessment based on the NVD description estimates a base score of 7.5–8.5 (High), modeled as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The high confidentiality impact reflects complete credential disclosure; the high integrity impact reflects the attacker's ability to modify router configuration (DNS, firewall rules) once credentials are recovered.

Business Impact:

• Credential Exposure: Compromise of the router admin password, WiFi PSK, and DDNS credentials. Reuse of these passwords on other systems (e.g., admin email, corporate VPN) amplifies the blast radius.
• Network Pivot: The WiFi PSK provides direct access to the internal LAN, bypassing perimeter controls.
• MitM / DNS Hijacking: With admin access, an attacker can modify DNS settings to facilitate credential pharming, intercepting corporate traffic to external services.
• Supply Chain Risk: For managed service providers (MSPs) maintaining fleets of AC12G routers for small-office clients, a single compromised backup file can expose credentials for multiple client networks.

Affected Systems: All Mercusys AC12G (EU) V1 units with firmware up to and including AC12G(EU)_V1_200909. This includes both home and small-office deployments in the European market.

Blast Radius: Low to Moderate — requires the attacker to obtain a backup file. However, the absence of a patch and the triviality of decryption make any leaked backup a guaranteed credential compromise.

Detection Guidance

Sigma Rule

title: Mercusys AC12G Configuration Backup Decryption Attempt
id: 7f3c2e9d-8a4b-4c2e-9d1f-2b3c4d5e6f7a
status: experimental
description: Detects offline decryption attempts of Mercusys AC12G backup files using hardcoded DES key patterns in script execution.
logsource:
  category: process_creation
  product: windows
detection:
  selection_python:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\pipenv.exe'
    CommandLine|contains|all:
      - 'DES'
      - 'ECB'
      - 'AC12G'
  selection_hashcat:
    Image|endswith: '\hashcat.exe'
    CommandLine|contains:
      - '1500'   # DES hash mode
      - '1400'   # SHA-256 (router backup hash)
  selection_file_access:
    # Backup file accessed outside admin hours
    Image|contains: 'explorer.exe'
    TargetFilename|contains:
      - 'config.bin'
      - 'backup.dat'
      - '*Mercusys*'
  condition: selection_python or selection_hashcat or selection_file_access
  timeframe: 15m
level: high
falsepositives:
  - Legitimate security research and vulnerability testing
  - Administrator accessing backup file for restoration purposes
fields:
  - CommandLine
  - Image
  - ParentImage
tags:
  - attack.t1552.001
  - attack.credential_access
  - cve.2026-36606

YARA Rule

rule Mercusys_AC12G_Backup_Decryption_Tool {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects scripts and binaries attempting to decrypt Mercusys AC12G config backups with hardcoded DES key"
        date = "2026-02-15"
        cve = "CVE-2026-36606"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36606"
        score = 85

    strings:
        // Hardcoded DES key references often found in PoC scripts
        $key_ref_1 = "8d2e4f6a1b3c5e7d" ascii wide
        $key_ref_2 = "des_key" ascii wide
        $key_ref_3 = "ECB" ascii wide
        $key_ref_4 = "pycryptodome" ascii wide
        // Router-specific strings in decryption tools
        $router_ref_1 = "AC12G" ascii wide
        $router_ref_2 = "Mercusys" ascii wide
        $router_ref_3 = "backup_config" ascii wide
        $router_ref_4 = "config.bin" ascii wide
        // DES encryption/decryption library imports
        $crypto_import_1 = "from Crypto.Cipher import DES" ascii
        $crypto_import_2 = "import Crypto.Cipher.DES" ascii

    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x457F) and
        (2 of ($key_ref_*) or 2 of ($router_ref_*)) and
        (1 of ($crypto_import_*) or 2 of ($router_ref_*))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-36606 - Mercusys AC12G Config Backup Download via Web Interface";
    flow:established,to_server;
    http.uri;
    content:"config.bin";
    http.uri;
    content:"backup";
    classtype:attempted-recon;
    sid:2026036601;
    rev:1;
    reference:cve,2026-36606;
    metadata:created_at 2026-02-15;
)

alert tcp any any -> any any (
    msg:"CVE-2026-36606 - Potential TFTP/FTP Backup Exfiltration of Mercusys Config";
    flow:established;
    content:"|00 01|";
    depth:2;
    content:"config";
    distance:0;
    content:".bin";
    distance:0;
    classtype:network-scan;
    sid:2026036602;
    rev:1;
    reference:cve,2026-36606;
    metadata:created_at 2026-02-15;
)

Elastic Detection

// Detect Python scripts executing DES-ECB decryption with hardware identifiers
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and
   process.name : ("python.exe", "python3.exe", "pipenv.exe") and
   process.command_line : ("*Crypto*", "*cryptography*", "*pycryptodome*") and
   process.command_line : ("*DES*", "*ECB*")]
  [file where event.type == "creation" and
   file.name : ("*config.bin*", "*backup.dat*", "*decrypted*", "*.json") and
   process.name : ("python.exe", "python3.exe")]

// Detect mass file access to router backup files across endpoints
any where event.category == "file" and
  file.name : ("config.bin", "backup.dat") and
  file.Ext.original.path : ("*Mercusys*", "*Downloads*", "*Desktop*", "*temp*")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| where EventCode=4663  // File access audit
| search Object_Name="*config.bin" OR Object_Name="*backup.dat"
| stats count by User, ComputerName, Object_Name, _time
| sort - count
| where count > 5
| eval threat="CVE-2026-36606 - Suspicious backup file access pattern"

| index=windows sourcetype=WinEventLog:Microsoft-Windows-PowerShell/Operational
| search Message="*DES*ECB*" OR Message="*pycryptodome*" OR Message="*config.bin*"
| stats values(Message) by User, ComputerName
| eval threat="CVE-2026-36606 - Potential decryption script execution"

Wazuh OSSEC Rule

<group name="mercusys_cve_2026_36606,">
  <rule id="100366" level="12">
    <if_sid>550, 553</if_sid>  <!-- New user login / syslog -->
    <match>config.bin|backup.dat|Mercusys|AC12G</match>
    <description>CVE-2026-36606: Mercusys AC12G config backup file detected on system</description>
    <group>credential_access,cve_2026_36606,</group>
    <mitre>
      <id>T1552.001</id>
    </mitre>
  </rule>

  <rule id="100367" level="15">
    <if_sid>100366</if_sid>
    <regex>python.*Crypto.*|DES.*ECB|hashcat.*1500</regex>
    <description>CVE-2026-36606: Decryption tool detected attempting to process router backup</description>
    <group>credential_access,cve_2026_36606,exploitation,</group>
    <mitre>
      <id>T1552.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No firmware update exists from Mercusys that replaces the hardcoded DES key or upgrades the encryption algorithm. This status was confirmed against vendor advisory feeds, OSV, and the NVD as of this report. Organizations must assume the vulnerability persists indefinitely on firmware AC12G(EU)_V1_200909 and earlier.

Immediate Mitigations (Days 0–7)

1. Rotate All Credentials: Immediately after any backup file exposure or as a precaution, rotate:
   • Router web-admin password
   • WiFi WPA2/3 PSK
   • DDNS service credentials
   • Any other credentials stored in the router configuration (e.g., static IP usernames, remote-management credentials)
2. Purge Backup Files: Delete all Mercusys AC12G configuration backup files (config.bin, backup.dat) from local drives, cloud storage, and email attachments. If backups must be retained, encrypt them with a separate, strong AES-256 container (e.g., VeraCrypt) or store them on an air-gapped medium.
3. Restrict Access to Backup Functionality: Implement strict role-based access control on the router's management interface — disable remote administration (port 80/443 exposure to the WAN), and restrict LAN-side admin access to specific trusted IPs only.
4. Network Segmentation: Place the router's management interface on a separate VLAN from the corporate or user network, preventing an attacker who joins the WiFi network from directly reaching the admin interface.

Patch / Upgrade Steps (Post-Immediate)

1. Contact Mercusys support (support@mercusys.com) to inquire about a firmware release that addresses this vulnerability. Reference CVE-2026-36606.
2. Monitor the Mercusys download center for new firmware for the AC12G (EU) V1. When a patched firmware is released, upgrade via the web interface after verifying the cryptographic hash from the vendor.
3. If no patch is forthcoming, replace the device with a model from a vendor with demonstrated firmware security practices (e.g., regular security bulletins, secure firmware update mechanisms, no known hardcoded-key issues).

Long-Term Hardening

1. Credential Governance: Ensure that the router admin password is unique and never reused across other systems. Use a password manager to track all device credentials.
2. Network Monitoring: Deploy the detection rules above (Sigma, Suricata, Elastic) to your SIEM to identify backup-file access and decryption attempts.
3. Asset Management: Maintain an inventory of all deployed routers, including firmware versions, and automate vulnerability scanning against this and other CVEs.
4. Procurement Policy: Add a requirement that network devices must not contain hardcoded credentials or use outdated cryptography (DES, RC4, MD5) as a vendor selection criterion.
5. Alternative Backup Process: If replacement is not immediately feasible, disable the router's built-in backup feature and manually record necessary settings in a secure password manager, restoring manually when needed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36606
2. Mercusys Support/Download Center: https://www.mercusys.com/en/support/downloads/
3. CWE-321 (Hardcoded Cryptographic Key): https://cwe.mitre.org/data/definitions/321.html
4. MITRE ATT&CK — T1552.001 (Credentials in Files): https://attack.mitre.org/techniques/T1552/001/
5. CISA KEV Catalog: Not listed (as of this report) — exploitation-in-the-wild has not been confirmed.

Threat Actor Attribution: As of this report, no known threat actor campaigns or exploit-in-the-wild activity have been publicly documented for this CVE. The low EPSS percentile (1.2%) suggests that adversaries have not yet integrated this into weaponized tooling. However, the ease of exploitation and the widespread availability of affected hardware in the EU SOHO market make this a likely candidate for future inclusion in commodity router-exploitation frameworks (e.g., ROUTERSPLOIT, Mirai-based variants).

Report generated: 2026-02-15 | Classification: TLP:CLEAR | Analysis by ValtersIT Threat Intelligence