CVE-2026-36610

Executive Summary

CVE-2026-36610 is a cryptographic and transport-layer vulnerability in the Mercusys AC12G (EU) V1 dual-band wireless router. The device's firmware (AC12G(EU)_V1_200909) transmits Dynamic DNS (DDNS) service credentials—specifically the username and password used to authenticate to third-party DDNS providers such as No-IP or DynDNS—over plaintext HTTP with only Base64 encoding applied. The firmware contains no TLS stack whatsoever, meaning every credential-bearing request sent to the DDNS update endpoint is recoverable by any network observer.

This vulnerability affects all Mercusys AC12G (EU) V1 devices running firmware version AC12G(EU)_V1_200909 or earlier. The impact is severe: a network-adjacent attacker—or any operator of a malicious Wi-Fi access point that a victim connects to—can trivially capture and decode DDNS credentials, then use them to hijack the victim's DDNS account, redirect the associated hostname to attacker-controlled infrastructure, and pivot into domain-based attacks against the victim's network.

Technical Analysis

The vulnerability resides in the DDNS client implementation within the Linux-based firmware of the Mercusys AC12G router. The device's embedded web management interface allows an administrator to configure DDNS updates by selecting a provider (e.g., No-IP, DynDNS, ChangeIP), entering a hostname, username, and password, and enabling the update service. When the router's periodic DDNS update cycle fires—typically every 10 to 60 minutes depending on the provider and firmware logic—the device constructs an HTTP GET request to the provider's update API.

The request follows the standard DDNS update format, e.g.:

GET /nic/update?hostname=myhost.ddns.net&myip=203.0.113.5 HTTP/1.1
Host: dynupdate.no-ip.com
Authorization: Basic <Base64("username:password")>

The vulnerability is twofold. First, the firmware does not implement any version of the Transport Layer Security (TLS) protocol—there is no OpenSSL or equivalent library linked into the DDNS update client. The request is sent over raw HTTP on TCP port 80. This exposes the full request URI and headers in cleartext. Second, while the Authorization header uses Basic authentication with Base64 encoding, Base64 is an encoding scheme, not encryption. It provides zero confidentiality: anyone who intercepts the packet can decode the credential pair in seconds with a single command (echo "<b64>" | base64 -d).

The absence of TLS is not a configuration omission but a fundamental firmware limitation. Static analysis of the firmware image reveals no TLS-related libraries, no certificate stores, and no HTTPS endpoints in the DDNS update path. The web management interface itself is also HTTP-only. This means there is no configuration option—short of a firmware update that does not currently exist—that would allow the administrator to enable encrypted DDNS updates.

The attack surface is broad. The credential transmission occurs on any network segment the router's WAN interface is attached to. From a remote attacker's perspective, the traffic is visible to any entity that controls a hop between the router and the DDNS provider—most practically, an ISP that performs deep packet inspection, or an attacker already present on the same network segment. Locally, a Wi-Fi attacker who has cracked the router's WPA2 passphrase (or who runs a rogue access point with an identical SSID that tricks the router into connecting) can capture the traffic without needing to compromise the router itself. Additionally, any attacker who has achieved a man-in-the-middle position via ARP spoofing or rogue DHCP on the LAN can intercept the router's outbound WAN traffic before it leaves the trust boundary.

Affected Version Determination

The affected firmware version is AC12G(EU)_V1_200909. The naming convention indicates EU regional variant, V1 hardware revision, and a build date of September 2009 (the trailing "200909"). No later firmware build has been released by Mercusys for this device (EU) variant as of the time of this report. Because the vulnerability is a missing implementation rather than a logic flaw, any firmware built from the same codebase without a TLS library is likely affected, though only the 200909 build has been formally verified and publicly reported.

Exploitation Scenarios

The following attack chain describes a realistic exploitation of CVE-2026-36610 from an adjacent network position.

Stage 1: Target Identification and Positioning (Reconnaissance)

The attacker performs Wi-Fi reconnaissance using tools such as airodump-ng or Kismet to identify a network broadcasting a SSID associated with a small office or home office (SOHO) environment. The attacker confirms the presence of a Mercusys AC12G router either through:

• Banner grabbing: connecting to the router's admin interface over HTTP and observing the login page title "Mercusys AC12G" or the Www-Authenticate realm header.
• Passive fingerprinting: running nmap -sV -p 80 <router-IP> to identify the HTTP server banner associated with the Mercusys firmware.
• A public Shodan query matching product:"Mercusys AC12G" to locate internet-facing routers (if the router's admin interface is exposed on WAN).

The attacker establishes a man-in-the-middle position. The most practical method is ARP spoofing on the LAN segment using Ettercap or Bettercap, redirecting the router's outbound traffic through the attacker's machine. Alternatively, the attacker may perform a WPA2 handshake capture, crack the passphrase offline, and then join the network legitimately to passively monitor traffic.

Stage 2: Credential Interception (Exploitation Trigger)

With the man-in-the-middle position active, the attacker begins a passive network capture using tcpdump or Wireshark, filtering for traffic destined to known DDNS provider IP ranges or domain names:

tcpdump -i eth0 -A 'port 80 and (dst host dns1.provider.com or dst host ddns.provider.com)'

The attacker waits for the router's periodically scheduled DDNS update request. The interval is firmware-determined but commonly falls between 10 minutes and 1 hour. Alternatively, the attacker can trigger an immediate update by:

• Accessing the router's admin interface (if the default admin credentials admin/admin are still active) and toggling the DDNS "Update" button.
• Causing the router's WAN IP to change (e.g., by disrupting the upstream DHCP lease), which typically forces an immediate DDNS update.

When the update fires, the attacker's capture logs a plaintext HTTP GET request to the DDNS provider's update endpoint. The Authorization: Basic header contains the Base64-encoded username:password string for the victim's DDNS account.

Stage 3: Credential Decoding and Account Takeover

The attacker extracts the Base64 token, for example bXl1c2VybmFtZTpwYXNzd29yZDEyMw==, and decodes it:

echo "bXl1c2VybmFtZTpwYXNzd29yZDEyMw==" | base64 -d

Output: myusername:password123

Stage 4: Post-Exploitation — DDNS Hostname Hijacking

With the valid DDNS credentials, the attacker gains full control over the victim's DDNS hostname (e.g., victim-home.ddns.net). The attacker performs the following actions:

1. Reconnaissance: The attacker queries DNS for the victim's current dynamic IP, then scans that IP for exposed services (SSH, RDP, web servers) to map the victim's externally reachable infrastructure.

2. Hostname Redirection: The attacker logs into the DDNS provider's API using the stolen credentials and updates the hostname's A record to point to an attacker-controlled server. This severs legitimate inbound connections to the victim's network.

3. GravityWell / Credential Harvesting: The attacker configures the attacker-controlled server to host a cloned login page mimicking the victim's VPN or remote access portal. Any users attempting to reach victim-home.ddns.net will be directed to the fake portal, where they will enter their credentials, which are logged by the attacker.

4. Persistence: Because the router uses the same DDNS credentials for periodic updates, the attacker can monitor the router's update requests to track when the victim's WAN IP changes, maintaining accurate visibility into the victim's connectivity.

5. Lateral Movement Potential: If the victim used the same password for the DDNS account as for their router admin account, email, or corporate VPN, the attacker can attempt credential stuffing against those services.

Impact Assessment

The vulnerability exposes the victim's DDNS credentials to any attacker who can observe the router's outbound network traffic. In practical terms, this includes LAN-adjacent attackers, Wi-Fi attackers who have gained network access, ISPs performing lawful or unlawful interception, and any malicious entity co-located on a transit network the router's traffic traverses.

The blast radius extends beyond the router itself. The DDNS hostname is typically used to reach the victim's home or small business network from the internet—for accessing NAS devices, security cameras, VPN servers, or remote desktop services. An attacker who hijacks the DDNS hostname effectively gains the ability to redirect all inbound remote-access traffic to attacker-controlled infrastructure, enabling phishing, credential harvesting, and denial of service against the victim's legitimate remote users.

The business impact varies by deployment:

• Small/Home Office: Loss of remote access to business systems, potential data theft if internal users are tricked into submitting credentials to the fake portal.
• Enterprise Edge: Mercusys AC12G is a consumer-grade device but may be deployed in branch offices or test environments. Credential disclosure in such environments could expose service account passwords that are reused across other infrastructure.
• Multi-tenant / Managed Wi-Fi: If deployed as a customer premises equipment (CPE) device, a service provider's entire customer base using this model becomes vulnerable to mass credential harvesting.

Confidentiality impact is High (the credential disclosure is trivial to exploit). Integrity impact is High (an attacker can redirect hostname resolution, effectively controlling the victim's public-facing identity). Availability impact is Medium (the victim's remote access services become unreachable once the hostname is redirected). The NVD has not assigned a CVSS vector to this CVE; based on the attack surface (network-adjacent, no authentication required, low complexity), a justified CVSS 3.1 score would fall in the High (7.0–8.9) severity band.

CISA KEV status: Not listed, meaning no known exploitation in the wild at CISA's cataloging point. However, given the simplicity of the attack (credential capture via passive sniffing) and the prevalence of consumer routers, exploitation is highly likely to emerge once the vulnerability is widely known.

Detection Guidance

Sigma Rule

The following Sigma rule detects HTTP requests containing a DDNS update pattern observed on a network egress point, which would expose the plaintext credential transmission:

title: Mercusys AC12G DDNS Credential Exfiltration Over HTTP
id: 5e7f3a2b-8d4c-4f6a-9b1e-3c2d4e5f6a7b
status: experimental
description: Detects plaintext HTTP requests to DDNS update endpoints originating from a Mercusys AC12G router, indicating credential transmission without TLS (CVE-2026-36610).
author: Valtersit Threat Intelligence
date: 2026-05-15
tags:
    - attack.t1040
    - cve.2026-36610
    - cwe.319
logsource:
    category: proxy
    product: web
detection:
    selection_ddns_path:
        http.url_path|contains:
            - '/nic/update'
            - '/update?'
            - '/dynamic/update'
    selection_http_method:
        http.method: 'GET'
    selection_plaintext:
        http.protocol: 'HTTP/1.1'
        http.connection_negotiated_protocol: null
        http.connection_established: 'false'
    condition: selection_ddns_path and selection_http_method and selection_plaintext
level: high
falsepositives:
    - Legitimate DDNS updates over HTTP from other non-compliant devices
    - Internal test scripts that intentionally use plaintext DDNS

YARA Rule

The following YARA rule scans PCAP files or log dumps for the Base64-encoded authorization header pattern and the DDNS update path that indicates CVE-2026-36610 exploitation:

rule Mercusys_AC12G_DDNS_Credential_Disclosure {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects plaintext HTTP requests with Authorization Basic header to DDNS update endpoints from Mercusys AC12G router"
        cve = "CVE-2026-36610"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36610"
    strings:
        $ddns_update = /\/nic\/update\?|\/update\?hostname=/ ascii nocase
        $auth_header = "Authorization: Basic " ascii nocase
        $http_method = "GET " ascii
        $http_version = " HTTP/1.1\r\n" ascii
        $base64_pattern = { 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3a 20 42 61 73 69 63 }  // "Authorization: Basic"
    condition:
        uint16(0) == 0x4d42 and  // MZ header (PE file, PCAP not handled here)
        all of them and filesize < 10MB
}

Note: The YARA rule above has a contradictory magic-byte check (PE file). The following is the corrected production rule for scanning raw packet captures:

rule Mercusys_AC12G_DDNS_Credential_Capture {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Matches PCAP or log content containing plaintext DDNS update requests with Basic auth from any source, indicative of CVE-2026-36610"
        cve = "CVE-2026-36610"
        date = "2026-05-15"
    strings:
        $ddns_update = "nic/update" ascii nocase
        $auth_header = "Authorization: Basic " ascii nocase
        $http_get = "GET " ascii
        $http_1_1 = "HTTP/1.1" ascii
        $ddns_provider1 = "no-ip.com" ascii nocase
        $ddns_provider2 = "dyndns.org" ascii nocase
        $ddns_provider3 = "changeip.com" ascii nocase
    condition:
        all of ($ddns_update, $auth_header, $http_get, $http_1_1) and
        any of ($ddns_provider*)
}

Suricata IDS Rule

The following Suricata rule detects plaintext HTTP requests from the router to DDNS update endpoints, triggering when the Authorization header with Basic scheme is present in a non-TLS stream:

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2026-36610 - Mercusys AC12G DDNS Credential Disclosure over HTTP"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/nic/update"; nocase; http.uri; content:"/update"; nocase; http.header; content:"Authorization: Basic "; nocase; http.protocol; content:"HTTP/1.1"; http.connection_state; content:"!TLS"; classtype:attempted-recon; sid:2026036610; rev:1; metadata:cve CVE-2026-36610;)

Alternatively, a packet-based rule for full capture on a span port:

alert tcp any any -> $HOME_NET 80 (msg:"CVE-2026-36610 - Mercusys AC12G DDNS plaintext credentials on WAN"; flow:to_server; content:"GET "; http.uri; content:"nic/update"; nocase; http.header; content:"Authorization: Basic "; nocase; flowbits:set,ddns_cred_exfil; classtype:attempted-user; sid:2026036611; rev:1;)

Elastic Detection

The following Elastic EQL rule detects outbound HTTP requests to known DDNS providers where the Authorization header is base64-encoded and the transport is plaintext HTTP:

sequence by source.ip
  [ network where network.protocol == "http" and
    http.request.method == "GET" and
    http.request.uri contains "nic/update" or
    http.request.uri contains "update?hostname" and
    http.request.headers.authorization starts with "Basic " ]
  [ network where network.transport == "tcp" and
    destination.port == 80 and
    not network.protocol == "tls" ]

Splunk SPL Query

The following Splunk query searches proxy/web logs for DDNS update requests that contain a Basic authorization header without TLS negotiation, indicating plaintext credential transmission:

index=web sourcetype=webserver_logs
| where isnull(ssl_subject) AND isnull(curl_session_ssl_verified)
| regex _raw="Authorization: Basic "
| regex _raw="GET .*?(nic/update|update\?hostname)"
| eval base64_token = replace(_raw, ".*Authorization: Basic ([^\s]+).*", "\1")
| convert base64(base64_token) as decoded_creds
| table _time, src_ip, dest_ip, uri, base64_token, decoded_creds
| search decoded_creds = "*"

For Zeek / network metadata logs:

index=bro sourcetype=bro:http:json
| search method=GET AND NOT ssl_protocol
| search uri IN ("*/nic/update*", "*update?hostname*")
| where match(raw, "Authorization: Basic ")
| table _time, id.orig_h, id.resp_h, uri, user_agent

Wazuh OSSEC Rule

The following Wazuh XML rule detects access to the router admin interface followed by a DDNS update, or matches a network capture log indicating plaintext credential transmission:

<group name="cve202636610,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">http</field>
    <field name="http.">response</field>
    <field name="http.method">GET</field>
    <match>nic/update</match>
    <regex>Authorization: Basic </regex>
    <description>Mercusys AC12G DDNS credentials transmitted over plaintext HTTP (CVE-2026-36610)</description>
    <group>credential_exposure,exploit,dns_update,</group>
    <mitre>
      <id>T1040</id>
    </mitre>
  </rule>

  <rule id="100002" level="7">
    <decoded_as>json</decoded_as>
    <field name="event_type">http</field>
    <field name="http.port">80</field>
    <field name="http.uri">/cgi-bin/luci;stok=.*/admin/ddns/update</field>
    <description>DDNS manual update triggered on Mercusys AC12G admin interface</description>
    <group>config_change,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — the vulnerability is UNPATCHED. No vendor advisory, firmware update, or CVE mitigation has been released by Mercusys (a subsidiary of TP-Link). The affected firmware build AC12G(EU)_V1_200909 remains the latest available version. This means the device will continue to transmit DDNS credentials in plaintext indefinitely unless the user takes alternate measures.

Immediate Mitigations (to apply today):

1. Disable the DDNS service on the router. Access the admin interface (http://192.168.0.1 default), navigate to Advanced → Network → Dynamic DNS, and set the service to Off. This eliminates the periodic plaintext credential transmission. Users who rely on DDNS should instead run a DDNS updater client on a PC, NAS, or Raspberry Pi on the LAN—these clients commonly support HTTPS-included updates.

2. Change the DDNS provider account password immediately. If the DDNS service has been running on the router for any period, assume the credentials have been exposed to anyone who has observed the network traffic. Log into the DDNS provider's web portal and rotate the password. Also audit the account's recent login activity and registered hostnames for unauthorized changes.

3. Segment the network. If the AC12G is used as the primary router, place it behind a properly secured upstream gateway/firewall that supports TLS inspection. This prevents an attacker on the WAN side from observing the router's outbound plaintext without also compromising the upstream device.

4. Replace the device. Given the absence of any patch, the only long-term remediation for those requiring DDNS on a router is to replace the AC12G with a model that supports HTTPS-based DDNS updates. TP-Link's Archer series, Asus routers, and OpenWrt-compatible devices (which include TLS libraries and allow configuring HTTPS for DDNS) are appropriate replacements.

Patch/Upgrade Steps:

• Check the Mercusys official support portal (mercusys.com) periodically for a firmware release post-dating 200909. If a new build appears, download and flash it according to the vendor's instructions, then verify with a packet capture that the DDNS update is sent to port 443 (TLS).
• If no update appears, the device is end-of-life from a security standpoint. Consider it unsupported and plan replacement.

Long-Term Hardening:

• Deploy a network intrusion detection system (Suricata/Snort) at the network edge using the rules provided in this report to detect any device transmitting credentials over plaintext.
• Enforce a policy of no cleartext protocols for any management or authentication traffic on the LAN.
• For enterprise environments, the Mercusys AC12G should be banned from production networks and replaced with managed equipment.
• Monitor the DDNS provider account for unauthorized hostname or IP changes using the provider's alerting features if available.

Threat Actor Activity:

At present, no publicly documented threat actor campaign has been attributed to CVE-2026-36610, and the CVE is not cataloged in CISA's Known Exploited Vulnerabilities list. However, the vulnerability class (plaintext credential transmission from embedded network devices) is a well-established target for botnet operators and credential harvesters. Given the trivial exploitation (passive sniffing, no authentication required), the absence of a patch, and the device's long support lifecycle (circa 2009), active exploitation is expected once the CVE gains mainstream awareness in scanning communities.

References

1. NVD Entry for CVE-2026-36610 — https://nvd.nist.gov/vuln/detail/CVE-2026-36610
2. Mercusys Official Support Portal — https://www.mercusys.com/en/support/ (check for AC12G firmware updates)
3. CWE-319: Cleartext Transmission of Sensitive Information — https://cwe.mitre.org/data/definitions/319.html
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-36610 currently NOT listed)
5. MITRE ATT&CK Technique T1040: Network Sniffing — https://attack.mitre.org/techniques/T1040/

Researcher Reporting: The vulnerability was reported via a public advisory by an independent researcher who analyzed the firmware image and identified the absence of TLS libraries alongside the Base64-encoded Basic authentication in the DDNS update path. The researcher released a proof-of-concept packet capture demonstrating the credential disclosure, but no weaponized exploit code has been publicly released.

Exploitation-in-the-Wild Evidence: None confirmed as of this report's publication. EPSS score of 0.00147 (4.4% percentile) reflects a low current probability of exploitation, consistent with the CVE being recently disclosed and requiring network-adjacent positioning. However, the practical attack barrier is minimal, and the score is expected to rise as the technique becomes more widely automated in tools such as Metasploit auxiliary modules and router-specific exploit kits.