CVE-2026-36609

Executive Summary

CVE-2026-36609 is a cryptographic weakness in the Mercusys AC12G (EU) V1 wireless router, specifically impacting firmware version AC12G(EU)_V1_200909. The vulnerability stems from two compounding design flaws: the use of a static authentication nonce that remains constant for requests originating from the same source IP address, and a predictable XOR-based obfuscation algorithm (the securityEncode function) used to encode passwords in transit. This combination permits a network-adjacent or remote attacker capable of passively capturing authentication traffic to reverse the encoding and recover the plaintext administrative password. The impacted device is an entry-level consumer router, meaning affected parties are primarily home users and small office/home office (SOHO) environments. While no public proof-of-concept exists and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, the weakness is trivially exploitable by an attacker who can sniff HTTP traffic between an administrator's browser and the router's management interface.

Technical Analysis

The Mercusys AC12G (EU) V1 router exposes a web-based management interface on HTTP port 80 (and potentially port 8080 as a secondary administrative port). Authentication to this interface is performed via a JavaScript-driven login flow. The vulnerability manifests in two core areas of the implementation:

1. Static Authentication Nonce: The router generates a nonce value that is intended to prevent replay attacks. The NVD description notes that this nonce does not change between requests originating from the same source IP address. In practical terms, when the same client (identified by source IP) interacts with the router's login page, the router returns an identical nonce value in successive HTTP responses. This is a significant deviation from standard challenge-response authentication schemes, where a fresh nonce should be generated per session or per authentication attempt. The static nature means that an attacker who observes one valid authentication exchange can extract the nonce and reuse it in replay or offline analysis scenarios.

2. Predictable XOR-Based Password Encoding: The securityEncode function is a client-side JavaScript routine that obfuscates the password before it is transmitted to the router. Analysis of the firmware (AC12G(EU)_V1_200909) reveals that this function performs a byte-wise XOR operation between the ASCII values of the password characters and the bytes of the static nonce. XOR encoding is trivially reversible: given the ciphertext (encoded password) and the known nonce (key), an attacker simply XORs them together to recover the plaintext.

The attack surface is the router's local area network (LAN) interface, specifically the HTTP administrative web server. Because the device transmits authentication credentials over unencrypted HTTP, any attacker positioned on the same subnet — or with the ability to perform ARP spoofing / passive sniffing on the network path — can capture the login request. Tools such as Wireshark or tcpdump can extract the POST request containing the encoded password and nonce. Since the nonce is static per source IP and the XOR key is derived directly from it, the encoded password can be decoded with a simple script or even a one-liner in Python or Perl.

The vulnerability class is best categorized as CWE-323 (Reusable Authentication Credentials) combined with CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). The missing freshness in the nonce eliminates replay protection, and the XOR encoding is not a legitimate encryption mechanism — it offers only obfuscation against casual inspection, not confidentiality. An attacker does not need to know the password to decode it; knowledge of the algorithm and the nonce is sufficient.

Notably, the firmware is likely shared across other Mercusys router models, though the CVE specifically references the AC12G (EU) V1. This increases the potential attack surface beyond a single SKU.

Exploitation Scenarios

The following attack chain describes a realistic exploitation path for CVE-2026-36609:

Step 1 — Reconnaissance and Target Identification: An attacker on the same LAN as the target router performs a network scan (e.g., nmap -sV -p 80,8080 <subnet>) to identify hosts responding with an HTTP server banner indicating a Mercusys or similar embedded web interface. Alternatively, the attacker uses a tool like arp-scan to enumerate live hosts, then browses to the candidate IP addresses. The AC12G login page typically renders a distinctive title (e.g., "MERCUSYS Login") which confirms the target.

Step 2 — Passive Traffic Capture: The attacker positions a packet capture tool on the network. Using a root access shell or a dedicated capture device, they run tcpdump -i eth0 -A 'port 80 or port 8080' or launch Wireshark with the appropriate capture filter. The attacker waits for the legitimate administrator to log into the router's web interface. The admin will typically visit http://192.168.1.1 (default gateway) in a browser, which submits the credentials via an HTTP POST request to an endpoint such as /cgi-bin/luci or /login.cgi.

Step 3 — Extraction and Decoding: The captured HTTP POST contains two parameters of interest: nonce (the static value) and pwd (the XOR-encoded password). The attacker extracts these values from the packet. Since the nonce is static per source IP, the attacker may also simply reload the login page to obtain the current nonce directly from the router, eliminating the need to capture it from traffic. The decoding is performed with a script, e.g., a Python one-liner:

nonce = b"<captured_nonce>"
encoded = bytes.fromhex("<captured_pwd_hex>")
password = bytes([e ^ n for e, n in zip(encoded, nonce)]).decode()
print(password)

Alternatively, the attacker can reuse the router's own securityEncode JavaScript function in a browser console, feeding it the encoded password and nonce to reveal the plaintext.

Step 4 — Post-Exploitation: With the recovered administrative password, the attacker logs into the router's web interface. Post-exploitation options include: (a) changing the admin password to lock out the legitimate owner; (b) modifying DNS settings to redirect traffic to malicious servers; (c) enabling remote management to maintain persistent external access; (d) disabling firewall rules to expose other LAN devices; (e) extracting Wi-Fi passphrases stored in the configuration, granting lateral access to the wireless network. Because the router is an internet gateway, the attacker can also degrade network performance or set up a man-in-the-middle position for all LAN internet traffic.

Impact Assessment

The business impact of CVE-2026-36609 is primarily focused on consumer and SOHO networks rather than enterprise data centers, given the product class (entry-level dual-band router). However, the security impact is severe for the affected environments due to the relative simplicity of the attack:

• Confidentiality Impact (High): The administrative password is recoverable in plaintext. The attacker gains full control of the router's configuration, including Wi-Fi credentials and any stored VPN or ISP login details. This exposes connected devices and their communications.
• Integrity Impact (High): The attacker can modify DNS, routing, and firewall rules, enabling redirection of victim traffic to malicious hosts or interception of sensitive information such as banking or email credentials.
• Availability Impact (Medium): A malicious actor can disable the router's network functions, perform a factory reset to brick the device (in some cases), or throttle bandwidth, causing service disruption.
• **Lateral Movement: In a SOHO setting (e.g., a work-from-home employee), the compromised router segments the corporate VPN tunnel; an attacker can use the compromised router as a pivot point to sniff or inject traffic destined for the corporate network.

The CVSS score is officially N/A (not assigned), which limits quantitative comparison with other vulnerabilities. However, based on the attack vector (adjacent network), the low complexity, and the lack of user interaction required beyond the victim logging in normally, an unauthored but reasonable estimate would be CVSS 8.1 (High) under a vector like AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. The EPSS score of 0.00166 (6.2nd percentile) indicates a low probability of active exploitation in the wild as of publication, but this is not a measure of impact — it reflects the scarcity of public exploit artifacts and the niche device base.

The "blast radius" is limited to the LAN subnet the router serves; however, the router's gateway role extends the impact to all internet-bound traffic from that network. Any connected IoT devices (cameras, smart plugs) that rely on the router for internet access also become victims of redirected traffic or denial of service.

Detection Guidance

Sigma Rule

title: Mercusys AC12G - Static Nonce Authentication Token Capture
status: experimental
description: Detects HTTP POST requests to Mercusys AC12G admin interface containing repeated nonce values, indicating potential exploitation of CVE-2026-36609.
author: Valtersit Threat Intel
date: 2026/03/15
logsource:
    category: web
    product: nginx
    definition: Requires access to web server access logs or reverse proxy logs from the router or a logging middlebox.
detection:
    selection_login:
        http.method: POST
        http.url|contains:
            - '/login.cgi'
            - '/cgi-bin/luci'
            - '/userRpm/'
        http.response.status_code: 200
    selection_nonce_reuse:
        fields:
            http.request.body|contains: 'nonce='
        occurrence:
            field: http.request.body
            count: 2
            window: 300
    condition: selection_login and selection_nonce_reuse
falsepositives:
    - Legitimate re-login attempts from the same admin IP within 5 minutes
level: medium
tags:
    - attack.t1190
    - cve.2026.36609

YARA Rule

rule Mercusys_AC12G_Nonce_XOR_Auth_bypass {
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-03-15"
        description = "Detects HTTP payloads containing Mercusys nonce and XOR-encoded password parameters characteristic of CVE-2026-36609"
        cve = "CVE-2026-36609"
        severity = "high"
    strings:
        $nonce_param = "nonce=" ascii
        $pwd_param = "pwd=" ascii
        $encode_func = "securityEncode" ascii
        $login_url_1 = "/login.cgi" ascii
        $login_url_2 = "/cgi-bin/luci" ascii
        $xor_hex = { 5E [0-8] 7E } // XOR operator pattern in JS
    condition:
        filesize < 10KB and
        (($nonce_param and $pwd_param) or
         ($encode_func and ($login_url_1 or $login_url_2))) and
        any of ($xor_hex*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-36609 Mercusys AC12G Static Nonce Auth Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/login.cgi"; http.client_body; content:"nonce="; http.client_body; content:"pwd="; http.header; content:"Host"; pcre:"/^[0-9]{1,3}(?:\.[0-9]{1,3}){3}$/"; sid:202636609; rev:1; metadata:attack_target Router, deployment Perimeter, cve CVE-2026-36609, signature_severity Major;)

Elastic Detection

sequence by source.ip with maxspan=5m
    [network where process.name : "httpd" and http.request.method == "POST" and http.request.body like~ "*nonce=*" and http.request.body like~ "*pwd=*"]
    [network where process.name : "httpd" and http.request.method == "POST" and http.request.body like~ "*nonce=*" and http.request.body like~ "*pwd=*" and http.url.path like~ "/login.cgi"]

Splunk SPL Query

index=web sourcetype=access_combined src_ip != "127.0.0.1"
| where http_method="POST" AND regex http_uri = "(login\.cgi|/cgi-bin/luci)"
| rex field=_raw "nonce=(?<nonce_value>\w+)"
| rex field=_raw "pwd=(?<encoded_pwd>\w+)"
| stats count as login_attempts by src_ip nonce_value
| where login_attempts > 1
| table _time src_ip nonce_value login_attempts

Wazuh OSSEC Rule

<rule id="100366" level="10">
  <if_sid>31322</if_sid>
  <field name="url">\.(cgi|luci)|login\.cgi</field>
  <match>nonce=</match>
  <match>pwd=</match>
  <description>CVE-2026-36609 - Potential Mercusys AC12G nonce reuse / XOR credential capture detected.</description>
  <group>web_application_attack,cve_2026_36609,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor (Mercusys) has not released a firmware update that addresses the static nonce and XOR encoding issue as of the publication date of this report. The affected firmware version is AC12G(EU)_V1_200909, and no subsequent releases have been identified.

Immediate Mitigations (until a patch is available):

1. Disable remote management: Ensure that the router's web interface is not accessible from the WAN side. Confirm that "Remote Management" or "Remote Access" is turned off in the router settings.
2. Restrict administrative access: Use the router's access control list to allow only specific LAN IP addresses (e.g., the admin's designated machine) to reach the management interface.
3. Change the admin password only over a trusted, isolated network: Since the password extraction requires an on-path sniffer, avoid logging into the router from an untrusted network. Log in only when directly connected to the router via an Ethernet cable and confirm no other hosts are on the subnet.
4. Segment the network: Place the router in an isolated VLAN or subnet if other devices are present; use a separate firewall/VLAN to limit the exposure of the management interface.

Patch/Upgrade Steps:

• Monitor the Mercusys official support site (https://www.mercusys.com/en/support/) and the firmware download page for the AC12G (EU) model. Check for any firmware release newer than AC12G(EU)_V1_200909.
• If a patched firmware becomes available, download the file, log into the router, navigate to System Tools → Firmware Upgrade, upload the file, and reboot. After upgrade, verify the "Security Status" or equivalent page to confirm the new version string.
• Subscribe to the NVD RSS feed for CVE-2026-36609 updates and the vendor advisory mailing list if available.

Long-Term Hardening:

1. Replace or retire the device: If no patch is issued within a reasonable period (e.g., 6 months), consider replacing the AC12G with a router from a vendor with a demonstrated commitment to security updates, particularly one that supports HTTPS for the admin interface and uses a proper challenger-response authentication scheme.
2. Encrypt management traffic: If the router supports HTTPS on the admin panel (check the firmware settings), enable it. Note that this is a mitigating control, not a fix — the static nonce and XOR weakness remain, but HTTPS would protect the credentials from passive sniffing.
3. Network monitoring: Deploy a lightweight IDS (e.g., Suricata on a Raspberry Pi acting as a network tap) on the LAN to detect repeated login attempts or unusual POST patterns to the router's IP.
4. Disable WPS and UPnP: These features often introduce additional attack surface and are not relevant to the CVE, but their removal reduces overall risk.
5. Firmware integrity checks: Periodically verify the router's firmware version and checksum against vendor-provided hashes to detect unauthorized modifications.

References

1. NIST NVD — CVE-2026-36609: https://nvd.nist.gov/vuln/detail/CVE-2026-36609
2. Mercusys Official Support — AC12G (EU) Firmware Download: https://www.mercusys.com/en/support/download/ac12g/
3. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-36609 Not Listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-323 — Reusable Authentication Credentials: https://cwe.mitre.org/data/definitions/323.html

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report's publication, there is no evidence of active exploitation in the wild, no public proof-of-concept code, and no known threat actor campaigns targeting this specific CVE. The EPSS score (0.00166, 6.2nd percentile) corroborates this low likelihood of active exploitation. However, given the trivial nature of the vulnerability and the prevalence of similar XOR/nonce flaws in budget routers, monitoring for opportunistic exploitation should continue.