CVE-2026-36608

Executive Summary

CVE-2026-36608 is an unauthenticated UPnP (Universal Plug and Play) vulnerability in the Mercusys AC12G (EU) V1 wireless router running firmware AC12G(EU)_V1_200909. The flaw resides in the AddPortMapping SOAP action, which fails to validate the InternalClient parameter against loopback or router-assigned IP addresses (192.168.1.1, 127.0.0.1). This allows any unauthenticated LAN-based attacker to issue a single SOAP request that forwards an external port directly to the router's administrative web interface. Once exposed, the admin panel becomes reachable from the internet, enabling remote brute-force, credential theft, and full device compromise. The vulnerability is confirmed unpatched (Patch Confidence 0/4), with no vendor advisory, fix, or workaround published as of this report. The CVSS score is N/A, but based on the attack vector (LAN-only, low complexity, high impact on confidentiality/integrity/availability), the effective severity is High. EPSS score is 0.00181, indicating low current exploit probability, but the device is an entry-level consumer router with a large installed base across the EU, elevating population-level risk.

Technical Analysis

The Mercusys AC12G (EU) V1 router implements the UPnP Internet Gateway Device (IGD) protocol, which listens on port 1900/UDP for SSDP discovery and on a TCP port (commonly 49152–49156) for SOAP control messages. The vulnerable function is the AddPortMapping action exposed by the WANIPConnection service. The expected behavior of this action is to forward an external port on the WAN interface to a specified InternalClient IP address and InternalPort on the LAN side. A correct implementation must reject mappings where the InternalClient is the router's own WAN IP, LAN gateway IP, or loopback address, to prevent the device from exposing its own management services.

In the affected firmware, the validation logic only checks that the InternalClient is a syntactically valid IPv4 address and that the external port is within an acceptable range. No check is performed to determine whether the target IP is a router-owned address. Consequently, an attacker can submit the following SOAP request:

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
      <NewRemoteHost></NewRemoteHost>
      <NewExternalPort>8080</NewExternalPort>
      <NewProtocol>TCP</NewProtocol>
      <NewInternalPort>80</NewInternalPort>
      <NewInternalClient>192.168.1.1</NewInternalClient>
      <NewEnabled>1</NewEnabled>
      <NewPortMappingDescription>pwn</NewPortMappingDescription>
      <NewLeaseDuration>0</NewLeaseDuration>
    </u:AddPortMapping>
  </s:Body>
</s:Envelope>

The router's UPnP stack accepts this request without authentication or CSRF protection. Because UPnP is designed to be LAN-trusted, no session tokens or cookies are required. The router then installs a NAT rule mapping WAN port 8080/TCP to IPv4 address 192.168.1.1 (the router's LAN interface) port 80/TCP (the admin web server). The same technique works with 127.0.0.1 as the InternalClient, relying on the router's loopback stack to deliver the traffic. The NewLeaseDuration field set to 0 indicates a permanent lease, meaning the mapping persists across reboots until explicitly removed.

The attack surface is the LAN interface of the router. Any device connected to the same Ethernet or Wi-Fi network—including guest networks if not properly isolated—can reach the UPnP control port without credentials. From the WAN side, a pre-authentication attack is not directly possible unless the UPnP service is exposed externally, which is uncommon. However, the impact of successful exploitation is complete exposure of the administrative interface to the internet, after which the router's admin credentials (default or weak) become the sole barrier to full device takeover.

The affected firmware version is AC12G(EU)_V1_200909. Since the NVD description does not reference a fixed version and the patch sources list is empty, the vulnerability must be considered present in all shipped variants of this firmware. The vendor (Mercusys, a sub-brand of TP-Link) has not yet responded with a security advisory or firmware update.

Exploitation Scenarios

Attack Chain — Unauthenticated LAN Attacker Exposes Admin Panel to Internet:

1. Reconnaissance and Target Identification (Tactic: TA0007 — Discovery): The attacker, connected to the victim's LAN (via rogue device, compromised IoT device, or open Wi-Fi), performs an SSDP discovery sweep by sending an M-SEARCH multicast request to 239.255.255.250:1900 with ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1. The Mercusys router responds with a 200 OK message containing its Location header, revealing the UPnP control URL, e.g., http://192.168.1.1:49152/upnp/control/WANIPConnection. The attacker records the WAN IP from the ExternalIPAddress field of the GetExternalIPAddress action to confirm the router is online.

2. Weaponization and Trigger (Tactic: TA0004 — Privilege Escalation via Misconfiguration): The attacker constructs a raw HTTP POST request to the control URL identified in step 1. The request body contains the SOAP AddPortMapping envelope with NewInternalClient set to 192.168.1.1 and NewExternalPort set to a commonly scanned port (e.g., 8080, 8443, or 443 if the admin listens on HTTPS). The attacker also sets NewExternalPort to a non-standard high port (e.g., 60080) to evade casual internet scanning. The HTTP headers include SOAPAction: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" and Content-Type: text/xml; charset="utf-8". The router processes the request and responds with 200 OK and an empty u:AddPortMappingResponse body, confirming the mapping was created.

3. Payload and Execution (Tactic: TA0009 — Collection / TA0011 — Persistence): No additional payload is required; the port mapping itself is the exploit. The attacker verifies success by performing a TCP connection test from an external host: nc -zv <WAN_IP> 60080. If the router's admin web server responds with an HTTP banner (e.g., HTTP/1.1 200 OK), the mapping is confirmed live. The attacker now has a direct path to the router's management interface.

4. Post-Exploitation Impact (Tactic: TA0006 — Credential Access / TA0005 — Defense Evasion): The attacker initiates a credential brute-force attack against the exposed admin panel using a wordlist of common router passwords (admin/admin, admin/password, admin/1234). Successful authentication grants full administrative control. The attacker may then: (a) modify DNS settings to redirect traffic to malicious servers; (b) enable remote SNMP or Telnet for persistent backdoor access; (c) disable UPnP and firewalls to remain undetected; (d) install custom firmware if the bootloader permits; (e) harvest network credentials by inspecting connected client lists and DHCP reservations; (f) use the router as a pivot for further lateral movement into the LAN. Because the port mapping has a lease duration of 0 (permanent), the exposure persists until manually removed via UPnP or factory reset, even across reboots.

Alternative Scenario — Malicious Website (Drive-by LAN Attack): A victim visits a malicious webpage while connected to the LAN. The page contains JavaScript that performs a DNS rebinding attack to bypass the browser's same-origin policy, allowing it to send cross-origin POST requests to the router's UPnP control port (the router's UPnP service typically sets the Access-Control-Allow-Origin: * header, or the rebinding technique resolves the victim's router IP). This enables a drive-by exploitation where merely visiting a website exposes the router's admin panel to the internet without any user consent or local malware.

Impact Assessment

The vulnerability has a high business and security impact for both home users and small offices (SOHO) deploying the Mercusys AC12G as their edge device. While the CVSS score is listed as N/A, a reasonable assessment based on the attack vector (Adjacent Network), attack complexity (Low), privileges required (None), user interaction (None), and scope (Changed) yields an approximate score of 8.1 (High) under CVSS 3.1. The confidentiality, integrity, and availability impacts are all High once the admin panel is exposed, as the attacker gains full device control.

Affected Systems: Only the Mercusys AC12G (EU) V1 hardware revision with firmware AC12G(EU)_V1_200909 is confirmed affected. However, the lack of a patch and the absence of a version history in NVD suggests the vulnerability likely also affects earlier firmware builds for this model and possibly other Mercusys/TP-Link derivatives using similar UPnP stack implementations. The device is widely sold through EU retail channels as a budget Wi-Fi 5 (802.11ac) router, targeting home consumers and small businesses.

Blast Radius: The primary blast radius is the device itself, but because a router guards the perimeter of the LAN, compromise has downstream effects: all connected devices become reachable for lateral movement, DNS tampering can redirect users to phishing sites, and the attacker can intercept or inspect unencrypted traffic by setting up port mirrors or enabling logging features. The secondary blast radius includes cloud account compromise if the attacker harvests credentials from unencrypted web sessions routed through the infected device. In an enterprise edge placement (unlikely but possible in small branch offices), the router's compromise could grant persistent access to the corporate network, bypassing perimeter security controls.

Exploit Probability: The EPSS score of 0.00181 (7.9th percentile) indicates a low probability of active exploitation within the next 30 days as of this report. However, this estimate predates any public proof-of-concept release. Given the simplicity of the exploit—a single SOAP request requiring no authentication and no zero-day tooling—we assess the probability of weaponization as high once the technical details circulate. There is no known instance of exploitation in the wild (CISA KEV: NO), and no threat actor groups have been publicly attributed to campaigns targeting this CVE.

Detection Guidance

The following detection content is designed to identify attempts to exploit CVE-2026-36608. Since the attack originates from the LAN side toward the router's UPnP control port, detection should focus on: (a) anomalous UPnP SOAP requests containing router-owned IP addresses in the NewInternalClient field; (b) internal hosts performing SSDP discovery for IGD devices; (c) unusual port mapping creation events.

Sigma Rule

title: Mercusys AC12G UPnP AddPortMapping to Router Admin Interface
id: 4e8f3f7a-9c2b-4a6e-bf5e-9c1d4e7a5b8f
status: experimental
description: Detects UPnP AddPortMapping SOAP requests that specify the router's own LAN IP (192.168.1.1) or loopback (127.0.0.1) as the InternalClient, indicating exploitation of CVE-2026-36608.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36608
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
    category: firewall
    product: linux
    definition: 'Requires UFW/nftables/iptables logs capturing HTTP POST traffic to UPnP control ports, or a Next-Gen Firewall (NGFW) with full HTTP body inspection.'
detection:
    selection_upnp:
        http.method: 'POST'
        http.url|contains: 'WANIPConnection'
    selection_http_body:
        http.body|contains:
            - '<NewInternalClient>192.168.1.1</NewInternalClient>'
            - '<NewInternalClient>127.0.0.1</NewInternalClient>'
            - 'NewInternalClient%3E192.168.1.1'
            - 'NewInternalClient%3E127.0.0.1'
    selection_soap_action:
        http.user_agent|contains: 'UPnP/1.1'
        http.header|contains: 'SOAPAction'
    condition: selection_upnp and selection_http_body and selection_soap_action
    timeframe: 1m
level: high
falsepositives:
    - 'Legitimate remote management tools that intentionally expose the admin interface via UPnP (rare, discouraged).'
    - 'Diagnostic UPnP tools run by network administrators during testing.'
tags:
    - attack.t1190
    - attack.t1543
    - cve.2026.36608

YARA Rule

rule CVE_2026_36608_Mercusys_UPnP_Admin_Exposure
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects UPnP AddPortMapping SOAP payloads targeting the router admin interface (CVE-2026-36608)"
        date = "2026-02-15"
        cve = "CVE-2026-36608"
        severity = "high"
    strings:
        $s_soap_action = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" ascii nocase
        $s_internal_client_router = "<NewInternalClient>192.168.1.1</NewInternalClient>" ascii nocase
        $s_internal_client_loopback = "<NewInternalClient>127.0.0.1</NewInternalClient>" ascii nocase
        $s_internal_client_var_router = "NewInternalClient=192.168.1.1" ascii nocase
        $s_internal_client_var_loopback = "NewInternalClient=127.0.0.1" ascii nocase
        $s_external_port_high = "<NewExternalPort>60080</NewExternalPort>" ascii nocase
        $s_enabled = "<NewEnabled>1</NewEnabled>" ascii nocase
        $s_lease_zero = "<NewLeaseDuration>0</NewLeaseDuration>" ascii nocase
    condition:
        uint16(0) == 0x0d0a and /* check for HTTP headers start */
        $s_soap_action and
        (
            $s_internal_client_router or
            $s_internal_client_loopback or
            $s_internal_client_var_router or
            $s_internal_client_var_loopback
        ) and
        (
            $s_external_port_high or
            $s_enabled
        ) and
        $s_lease_zero
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 49152:49156 (msg:"CVE-2026-36608 Mercusys UPnP AddPortMapping to Admin IP 192.168.1.1"; flow:established,to_server; content:"POST"; http_method; content:"WANIPConnection"; http_uri; content:"SOAPAction"; http_header; content:"#AddPortMapping"; http_header; content:"<NewInternalClient>192.168.1.1</NewInternalClient>"; http_client_body; content:"<NewLeaseDuration>0</NewLeaseDuration>"; http_client_body; reference:cve,2026-36608; classtype:attempted-admin; sid:10036608; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, attack_target router, deployment perimeter, signature_severity Critical, tag cve-2026-36608, tag upnp, tag router, tag mercusys;)

alert tcp $HOME_NET any -> $HOME_NET 49152:49156 (msg:"CVE-2026-36608 Mercusys UPnP AddPortMapping to Localhost 127.0.0.1"; flow:established,to_server; content:"POST"; http_method; content:"WANIPConnection"; http_uri; content:"SOAPAction"; http_header; content:"#AddPortMapping"; http_header; content:"<NewInternalClient>127.0.0.1</NewInternalClient>"; http_client_body; content:"<NewLeaseDuration>0</NewLeaseDuration>"; http_client_body; reference:cve,2026-36608; classtype:attempted-admin; sid:10036609; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15, attack_target router, deployment perimeter, signature_severity Critical, tag cve-2026-36608, tag upnp, tag router, tag mercusys;)

Elastic Detection

network where event.category == "network" and network.protocol == "http" and
  process.name != null and
  user.id != null and
  destination.port >= 49152 and destination.port <= 49156 and
  http.request.method == "POST" and
  url.path like "*WANIPConnection*" and
  (
    http.request.body.content like "*<NewInternalClient>192.168.1.1</NewInternalClient>*" or
    http.request.body.content like "*<NewInternalClient>127.0.0.1</NewInternalClient>*"
  ) and
  http.request.body.content like "*#AddPortMapping*"

Splunk SPL Query

index=netflow OR index=proxy OR index=web
| where dest_port >= 49152 AND dest_port <= 49156
| where http_method="POST"
| search http_uri="*WANIPConnection*"
| search http_body="*<NewInternalClient>192.168.1.1</NewInternalClient>*" OR http_body="*<NewInternalClient>127.0.0.1</NewInternalClient>*"
| rex field=http_body "NewExternalPort>(?<external_port>.*?)</"
| rex field=http_body "NewInternalPort>(?<internal_port>.*?)</"
| rex field=http_body "NewLeaseDuration>(?<lease_duration>.*?)</"
| table _time, src_ip, dest_ip, dest_port, external_port, internal_port, lease_duration, http_body
| eval exposure_created = if(lease_duration=="0" OR external_port=="8080" OR external_port=="60080", "CRITICAL", "SUSPICIOUS")
| sort - _time
| where exposure_created="CRITICAL"
| rename _time as Timestamp, src_ip as Attacker_IP, dest_ip as Router_IP

Wazuh OSSEC Rule

<group name="upnp,">
  <rule id="366080" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="url">.*WANIPConnection.*</field>
    <description>CVE-2026-36608: UPnP AddPortMapping to router admin IP (192.168.1.1/127.0.0.1) attempted</description>
    <group>access_control,router,upnp,</group>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="366081" level="12">
    <if_sid>366080</if_sid>
    <match>SOAPAction.*#AddPortMapping</match>
    <description>CVE-2026-36608: Confirmed AddPortMapping SOAP action targeting admin interface</description>
    <group>attack,router,upnp,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (0/4 confidence). No firmware update, vendor advisory, or security fix exists for CVE-2026-36608 as of this report. The vendor (Mercusys) has not acknowledged the vulnerability or provided an ETA for remediation. The following steps should be taken immediately:

1. Immediate Mitigations:

   • Disable UPnP entirely on the router. Access the admin panel (192.168.1.1 from a wired connection) → Advanced Settings → NAT or Network → disable "UPnP". This eliminates the attack surface entirely. If UPnP is required for gaming devices or VoIP, weigh the risk against convenience; for a vulnerable device, disable it until patched.
   • Change default admin credentials immediately. Use a strong, unique password (16+ characters) to prevent brute-force success even if the admin panel is exposed.
   • Enable WPA2/WPA3 encryption on Wi-Fi with a pre-shared key. Do not use WPS (Wi-Fi Protected Setup); if enabled, disable it, as WPS PIC attacks can bypass Wi-Fi security.
   • Segment the network: If the router supports a guest network, ensure guest clients are isolated from the main LAN (AP isolation). Do not allow guest network traffic to reach the router's management interface.
   • Monitor UPnP port mappings: Regularly check the router's NAT table for unexpected entries. Ports like 60080, 8080, or 8443 mapping to 192.168.1.1 or 127.0.0.1 indicate compromise.

2. Patch/Upgrade Steps:

   • Check for firmware updates on the official Mercusys support site (https://www.mercusys.com/en/support/download/) on a weekly basis. Search for "AC12G (EU)" and compare the latest firmware version against AC12G(EU)_V1_200909. If a newer version is released, apply it via the web interface: System Tools → Firmware Upgrade → Browse → Upload. Do not download firmware from third-party mirrors.
   • Subscribe to vendor security advisories and RSS feeds from the Mercusys/TP-Link security center. The vulnerability will likely be fixed under a TP-Link or Mercusys security bulletin in a future update.
   • If no update arrives within 60 days, consider replacing the device with a hardware revision (V2/V3) or a router from a vendor with a stronger patch cadence. Budget AC routers with known security posture issues should not be deployed as edge devices.

3. Long-Term Hardening:

   • Replace consumer routers in business contexts with enterprise-grade devices (e.g., Ubiquiti UniFi, MikroTik) that support centralized logging, VLAN segmentation, and automated firmware updates.
   • Implement perimeter firewall rules on an external firewall (if deployed upstream) to block inbound connections to the router's WAN IP on non-essential ports. If the ISP modem is separate, configure its firewall to deny unsolicited inbound traffic except explicitly required services.
   • Deploy intrusion detection using the Sigma, Suricata, and Splunk rules provided above. Feed UPnP control traffic to a monitoring solution to detect rogue mappings in real time.
   • Regularly audit UPnP implementations: Use tools like upnpc -s (Linux) or MiniUPnP clients to list existing port mappings. Anomalous entries mapping to the router's own IP should be treated as a security incident.
   • If the device is already suspected of compromise, perform a factory reset, upgrade firmware (if available), change credentials, disable UPnP, and review DNS settings to ensure they were not changed. Consider the device compromised and monitor the LAN for lateral movement.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36608
2. MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-36608
3. Mercusys Support/Downloads: https://www.mercusys.com/en/support/download/ (monitor for future AC12G firmware updates)
4. OWASP UPnP Security Risks: https://owasp.org/www-community/UPnP_Proxy_Attack (background on UPnP abuse; note: not specific to this CVE)
5. FIRST EPSS Data: https://www.first.org/epss/ (search CVE-2026-36608 for score evolution)

Threat Actor/Campaign Intelligence: As of this report, there are no known threat actors, exploit campaigns, or in-the-wild exploitation of CVE-2026-36608. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. No public PoC or exploit code has been released (POC_STATUS: None). However, historical precedent (e.g., Mirai botnet's exploitation of default credentials and UPnP weaknesses, the 2020 "CallStranger" UPnP vulnerability) indicates that router UPnP flaws are frequently targeted by IoT botnets once details become public. SOC teams should treat remote access attempts to ports 60080, 8080, 8443, and 443 on residential/SOHO IP ranges with elevated suspicion in the coming months, as the vulnerability disclosure (even without a PoC) lowers the barrier for independent weaponization by other actors.