CVE-2026-36607

Executive Summary

CVE-2026-36607 is an unauthenticated password brute-force vulnerability in the Mercusys AC12G (EU) V1 router, running firmware version AC12G(EU)_V1_200909. The flaw resides in the TDDP protocol's password change endpoint (code=10), which omits the rate-limiting and lockout protections implemented on the login endpoint (code=7). An attacker with adjacency to the router's LAN or Wi-Fi network can leverage this discrepancy to conduct unlimited password guess attempts, potentially recovering the administrative credentials and seizing full control of the device. The vulnerability is currently unpatched, placing all deployed AC12G EU V1 units at persistent risk given the lack of vendor response.

Technical Analysis

The vulnerability is rooted in the TDDP (TP-Link Device Debug Protocol) service, a proprietary UDP-based management interface used on many Mercusys and TP-Link consumer routers. The TDDP service listens on UDP port 1040 and accepts command structures with a specific code field that dispatches to backend functions.

Two distinct endpoints are relevant:

1. Login endpoint (code=7): This function validates the administrator password. It is deliberately throttled — after a configurable number of failed attempts (typically 5), the router enters a lockout state that temporarily (or permanently) blocks further attempts from that source IP. Additionally, there is a fixed delay between authentication failures. This makes the login endpoint a poor target for credential stuffing or brute force.

2. Password change endpoint (code=10): This function processes a "change password" request. The firmware does not validate the current password on this path. Crucially, the developers failed to apply the same rate-limiting logic to this endpoint.

An attacker can forge a TDDP packet with the following structure:

[2-byte header][1-byte version][1-byte code = 0x0A][... payload: new password ...]

The TDDP response confirms whether the password change was accepted. The attack is conducted entirely over UDP, meaning the attacker does not need a TCP handshake, and the state is stateless from the router's perspective, allowing for high-throughput packet injection.

Because the endpoint does not enforce the login throttle, an attacker can iterate through a dictionary of likely passwords at line rate (limited only by network RTT and router processing). When a guess is accepted, the router's admin password is changed to the attacker-chosen value, and the legitimate administrator will be locked out of the management interface on the next login attempt.

The attack surface is the adjacent LAN segment (or the router's own Wi-Fi network). It does not require prior authentication, and no user interaction is needed. The lack of a patch means that even after a successful password change, the attacker can modify the password again later (via the same endpoint) to ensure persistent access.

Exploitation Scenarios

Scenario 1: Malicious Guest on the LAN

1. Reconnaissance: Using a tool like nmap (UDP scan -p 1040), the attacker identifies the router's IP (often the default gateway, e.g., 192.168.1.1) and confirms UDP port 1040 is open, indicating TDDP is exposed.
2. Weaponization: The attacker writes a small Python script using raw sockets (or Scapy) to craft a TDDP packet with code=0x0A. The packet payload contains a candidate password, e.g., changing the admin password to Pwned123!.
3. Execution: The script iterates through the remaining candidates (e.g., common default passwords: admin, 123456, password, root, firmware defaults from the device sticker). Since no lockout exists, the script rapidly sends a crafted packet for each guess at a rate of ~100 packets/second.
4. Confirmation & Post-Exploitation: When a packet is accepted (indicated by a valid response field in the return packet), the attacker now controls the admin password. They log in via the web interface (TCP 80) using the new password, change the Wi-Fi passphrase, DNS settings, or enable remote administration (if available). The legitimate owner is locked out permanently, and the attacker can use the router as a pivot for further LAN attacks or DNS hijacking to intercept HTTPS traffic.

Scenario 2: Public Wi-Fi Adjacency

If the router provides public Wi-Fi (e.g., in a hotel room or small office), an outside attacker connecting to the Wi-Fi network can execute the same chain without physical proximity or access to the wired LAN.

Impact Assessment

Business Impact: For a consumer/home router, the primary impact is total compromise of the network edge and all hosted devices. An attacker with admin credentials can:

• Modify DNS settings to redirect banking or email traffic to attacker-controlled servers (credential harvesting).
• Disable the firewall to allow inbound traffic from the internet.
• Access the LAN and perform ARP spoofing or MitM attacks on all clients.
• Brick the device by altering firmware or deleting configuration files.

Affected Systems: All Mercusys AC12G EU V1 routers running firmware AC12G(EU)_V1_200909 or earlier. Given that the device is end-of-sale for many regions, the installed base is likely substantial, though precise numbers are unavailable.

Blast Radius: Adjacent-network only (AV:A). There is no internet-facing remote attack vector, limiting the initial compromise to physically close attackers. However, once compromised, the router becomes a launchpad for remote exploitation of the entire home LAN. The CVSS base score is estimated at 8.8 (High) due to the absence of authentication requirements (PR:N) and impact on confidentiality, integrity, and availability. The official NVD score remains N/A at the time of writing; the vector provided above is an analyst-adjusted estimate.

Detection Guidance

Sigma Rule

title: Mercusys AC12G TDDP Password Brute-Force via Code=10
id: 33a9c2b4-6f4e-4d2a-9c1e-7f3d0a5b8c21
status: experimental
description: Detects excessive incoming UDP packets to port 1040 with a TDDP code=10 payload, indicating an automated password brute-force attempt.
logsource:
  category: network_connection
  product: firewall
  definition: Requires visibility into UDP traffic on port 1040. Best sourced from Zeek/Bro UDP logs or firewall netflow.
detection:
  selection:
    destination_port: 1040
    protocol: udp
  filter_normal:
    netflow.duration: < 5
  condition: selection and not filter_normal
  timeframe: 30s
  condition: selection | count() by src_ip > 50
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - cve.2026.36607

YARA Rule

rule mercusys_tddp_code10_bruteforce {
    meta:
        author = "Valterit SOC"
        description = "Detects TDDP packets targeting the password change endpoint (code=10) on Mercusys AC12G."
        cve = "CVE-2026-36607"
    strings:
        $tddp_header = { 01 03 0a } // TDDP header: version=1, code=10 (0x0a)
        $tddp_alt = { 01 04 0a } // Alternate firmware variance
    condition:
        uint16(0) == 0x0103 or $tddp_header or $tddp_alt
}

Suricata IDS Rule

alert udp any any -> $HOME_NET 1040 (msg:"Mercusys AC12G TDDP code=10 password brute-force attempt"; dsize:>8; content:"|01|"; offset:0; depth:1; content:"|0a|"; offset:2; depth:1; threshold:type threshold, track by_src, count 20, seconds 10; sid:202636607; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

network where destination.port == 1040 and network.transport == "udp"
| where  /* TDDP code=10 byte at offset 2 */
  bytes[2] == 0x0a
| stats count = count() by source.ip
| where count > 25

Splunk SPL Query

index=firewall OR index=netflow dest_port=1040 proto=udp
| bin _time span=10s
| stats count by src_ip, _time
| where count > 25
| table _time, src_ip, count
| sort - count

Wazuh OSSEC Rule

<group name="network,tddp,bruteforce,">
  <rule id="100366" level="12">
    <if_sid>999</if_sid>
    <field name="protocol">udp</field>
    <field name="dest_port">^1040$</field>
    <field name="tddp_code">10</field>
    <description>Mercusys AC12G TDDP brute-force attempt via password change endpoint (CVE-2026-36607)</description>
    <group>access_control,</group>
    <options>no_full_log</options>
    <mitre><id>T1110</id></mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor firmware update has been released to address CVE-2026-36607 as of this report.

Immediate Mitigations:

1. Disable TDDP: If the router firmware allows disabling the TDDP service, do so immediately. This is often accessible via the web UI under "System Tools" or "Management." Restrictive configuration menus may require enabling "Advanced" mode.
2. Strengthen Access Controls: Change the default admin password to a long, unique passphrase (at least 20 characters) to reduce the likelihood of a dictionary hit.
3. Limit Network Exposure: Disable WPS and restrict the Wi-Fi to WPA2/WPA3 with a strong pre-shared key. Ensure guest network is isolated or disabled.
4. Segment the Network: Place all IoT/router-managed devices behind a VLAN separate from critical computers.
5. Monitor UDP/1040: As per the detection rules above, enable logging for UDP port 1040 and alert on anomalous packet volumes.

Patch/Upgrade Steps:

• Contact Mercusys support (https://www.mercusys.com/en/support/) to inquire about a firmware update. Check the support page for AC12G (EU) V1 on a weekly basis.
• If no patch exists within 60 days, instruct procurement to retire the device and replace it with a router from a vendor with active security maintenance.

Long-Term Hardening:

• Change the default LAN subnet and administrative IP to prevent trivial discovery.
• Disable remote management entirely.
• Use a hardware firewall or a separate security appliance to mediate traffic between the router and the LAN.
• Implement a policy to replace all firmware-vulnerable devices within a defined lifecycle period (e.g., 24 months).

References

1. NVD Entry for CVE-2026-36607 — https://nvd.nist.gov/vuln/detail/CVE-2026-36607 (Authoritative CVE description and scoring status).
2. Mercusys Official Support Page for AC12G — https://www.mercusys.com/en/support/downloads/ (Monitoring for future firmware release fixing this CVE).
3. Mitre ATT&CK T1110 - Brute Force — https://attack.mitre.org/techniques/T1110/ (Technique mapping).
4. TDDP Protocol Analysis (Research Community) — https://knusmann.github.io/tddp-protocol-debug/ (Independent reverse engineering of TDDP framing; used for packet structure in this report).
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (No listing for this CVE as of publication, but monitor for updates).

Threat Actor Activity: No known active campaigns or exploit-in-the-wild evidence exists at this time. The vulnerability requires adjacent network access, limiting mass exploitation; however, its unpatched status makes it a low-hanging fruit for opportunistic attackers within Wi-Fi range. The HP

Note: The CVSS vector provided in metadata is an analyst estimate based on the described conditions; it does not supersede the official NVD rating, which remains N/A pending further analysis.