CVE-2026-36611

Executive Summary

CVE-2026-36611 is an uninitialized memory disclosure vulnerability in the Mercusys AC12G (EU) V1 wireless router, specifically in firmware version AC12G(EU)_V1_200909. When the device receives POST requests lacking a SOAPAction header on UPnP port 1900, it returns 128 bytes of uninitialized buffer contents, potentially exposing sensitive internal memory data to unauthenticated adjacent network attackers. The vulnerability has no known patch, no CISA KEV listing, and a low EPSS score of 0.00231, but the information disclosure risk persists for affected devices in LAN environments.

Technical Analysis

The vulnerability resides in the UPnP (Universal Plug and Play) stack of the Mercusys AC12G router. The affected firmware version AC12G(EU)_V1_200909 processes SOAP-based control requests on UDP port 1900 (SSDP discovery) and TCP port 1900 (SOAP control). The flaw manifests specifically when a POST request is sent to the UPnP control endpoint without the standard SOAPAction HTTP header.

Upon receiving such malformed requests, the UPnP service handler attempts to respond. However, instead of returning an appropriate HTTP error message with a controlled status body, the device's firmware retrieves a response buffer that has not been properly memset or initialized before use. This results in the response containing 128 bytes of stale data from the router's heap or stack memory regions—residual data from prior operations, potentially including Wi-Fi passphrases, admin credentials, HTTP session tokens, network configuration parameters, DNS query data, or neighboring device information.

The vulnerability mechanism can be summarized as follows:

1. The UPnP control server binds to TCP port 1900 and accepts HTTP connections from adjacent devices.

2. An HTTP POST request is parsed by the firmware's SOAP handler. The handler checks for the presence of the SOAPAction header to route the request to the appropriate UPnP action dispatcher.

3. If the header is missing, the parser enters an error-handling path. The error handler prepares an HTTP error response, but the body buffer is allocated without zeroing or initialization.

4. The response builder copies the uninitialized buffer contents directly into the HTTP response, transmitting up to 128 bytes of residual memory to the requesting client.

5. Since UPnP requires no authentication by design, any host on the adjacent L2 network segment (same broadcast domain) can repeatedly trigger this behavior to harvest memory contents over time.

Attack surface elements:

• Protocol: HTTP over TCP port 1900 (UPnP SOAP control)
• Authentication: None required (UPnP standard)
• Compromise vector: Adjacent network access (same LAN or VLAN)
• Exploit complexity: Low — a simple curl or Python socket request is sufficient
• Memory disclosure volume: 128 bytes per request, repeatable indefinitely

The CWE classification is UNKNOWN per provided data, but the vulnerability pattern aligns with CWE-457 (Use of Uninitialized Variable) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The lack of a CNA-provided title and the limited vendor description suggest this was discovered through either coordinated disclosure research or independent security auditing of the firmware.

Firmware version AC12G(EU)_V1_200909 corresponds to a 2020.09 release date based on the version scheme. The device is the EU variant of the AC1200 Gigabit Wi-Fi router, which is widely deployed in home and small office environments across Europe.

Exploitation Scenarios

The following attack chain describes a realistic exploitation scenario against an affected Mercusys AC12G router. While no public PoC exists at the time of writing, the technique is straightforward given the vulnerability's nature.

Stage 1 — Reconnaissance and Target Identification

1. The attacker first gains access to the target network — either by connecting to an open guest Wi-Fi SSID (a common configuration on home routers), by attacking the Wi-Fi pre-shared key (WPA2/WPA3 brute force or phishing), or by plugging into an exposed LAN port in an office environment.

2. Once on the L2 segment, the attacker performs UPnP discovery. They send an M-SEARCH SSDP query to the multicast address 239.255.255.250:1900 with the header MAN: "ssdp:discover" and MX: 3. The Mercusys device responds with its device descriptor URL, typically http://<router-ip>:1900/rootDesc.xml.

3. The attacker enumerates all UPnP services by requesting the root device descriptor XML, which lists service control URLs. The WANIPConnection service (or equivalent) exposes the control URL, typically http://<router-ip>:1900/ctl/IPConn.

4. The attacker verifies the firmware version by probing the device's web admin interface on port 80 and extracting the firmware string AC12G(EU)_V1_200909 from the HTTP response headers or the login page source, confirming the target is vulnerable.

Stage 2 — Trigger and Weaponization

1. The attacker sends a raw HTTP/1.1 POST request to the control URL on port 1900 with the following structure:

   POST /ctl/IPConn HTTP/1.1
   Host: <router-ip>:1900
   Content-Type: text/xml; charset="utf-8"
   Content-Length: 245
   
   <?xml version="1.0"?>
   <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
     <s:Body>
       <u:GetExternalIPAddress xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
       </u:GetExternalIPAddress>
     </s:Body>
   </s:Envelope>
   

   Critically, the request omits the SOAPAction header entirely. Standard SOAP requests to UPnP endpoints must include this header to be valid; its absence triggers the vulnerable code path.

2. The attacker can automate this using a simple Python script:

   import socket, re
   
   target_ip = "192.168.1.1"
   payload = (
       "POST /ctl/IPConn HTTP/1.1\r\n"
       f"Host: {target_ip}:1900\r\n"
       "Content-Type: text/xml; charset=\"utf-8\"\r\n"
       "Content-Length: 245\r\n"
       "\r\n"
       "<?xml version=\"1.0\"?>\r\n"
       "<s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\">\r\n"
       "<s:Body>\r\n"
       "<u:GetExternalIPAddress xmlns:u=\"urn:schemas-upnp-org:service:WANIPConnection:1\">\r\n"
       "</u:GetExternalIPAddress>\r\n"
       "</s:Body>\r\n"
       "</s:Envelope>\r\n"
   )
   
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.settimeout(5)
   s.connect((target_ip, 1900))
   s.send(payload.encode())
   response = s.recv(4096)
   # Parse out the 128-byte uninitialized buffer:
   # Look for the response body after the \r\n\r\n separator
   body = response.split(b"\r\n\r\n", 1)[1] if b"\r\n\r\n" in response else response
   print(f"Memory leak dump:\n{body.hex()}")
   s.close()
   

3. The device responds with an HTTP error (likely 500 Internal Server Error or similar), but crucially includes the 128-byte uninitialized buffer in the response body. The attacker records the raw binary data.

4. The attacker repeats the request thousands of times over an extended session, each time harvesting a new 128-byte chunk of memory. Since the router handles many concurrent operations (ARP handling, DHCP leases, NAT sessions, DNS caching, Wi-Fi client management), successive requests return different memory regions, gradually mapping out the device's memory landscape.

Stage 3 — Payload and Data Extraction

1. The attacker performs pattern analysis on leaked buffers, searching for ASCII strings, hex sequences, and predictable structures. Techniques include:

   • strings command on collected buffers to identify plaintext fields.
   • Regex mining for patterns matching MAC addresses, IP addresses, SSID names, and WPA key formats.
   • Heap feng shui: by inducing specific router operations (e.g., triggering NAT table entries via outbound connections, adding Wi-Fi clients to the ARP cache), the attacker places known data in memory regions that will subsequently leak.

2. High-value targets for extraction include:

   • Wi-Fi WPA2-PSK passphrase (could be in adjacent memory if the router stores it in a cleartext config block).
   • Admin login session cookies/tokens from recent HTTP admin panel logins.
   • DHCP lease information revealing client device identities.
   • DNS query data exposing user browsing behavior.
   • Router admin password if stored in plaintext or weakly encoded form.

3. In a home network scenario, obtaining the Wi-Fi passphrase enables credential reuse attacks — users frequently use the same passphrase for admin access. In a business context, extracting internal hostnames and MAC addresses enables further lateral movement and ARP spoofing attacks.

Stage 4 — Post-Exploitation Impact

1. With router admin credentials (if leaked), the attacker gains full device control: can modify DNS settings (DNS hijacking), enable remote management, disable firewall rules, redirect traffic, or install firmware backdoors if the device supports unsigned firmware updates.

2. Even without credentials, the memory leak serves as an intelligence-gathering platform for subsequent attacks against LAN devices.

3. The attacker can maintain persistence by periodically harvesting memory to capture new credentials as they change.

This vulnerability requires adjacent network access, meaning remote attackers must first penetrate the network perimeter. However, in vulnerable configurations (guest Wi-Fi on the same broadcast domain, insecure WPS, exposed LAN ports), the adjacent network requirement is easily satisfied.

Impact Assessment

The vulnerability carries a CVSS score of N/A per the provided intelligence metadata, which is atypical and likely reflects incomplete vendor disclosure rather than a zero-risk assessment. The EPSS score of 0.00231 places this CVE at the 14.1st percentile of exploited CVEs, indicating that weaponized exploits are not currently widespread. The CISA KEV (Known Exploited Vulnerabilities) catalog does not list this CVE, confirming no documented in-the-wild exploitation as of the report date.

Business Impact Severity: Medium

The primary impact dimension is confidentiality — specifically, the exposure of internal router memory to unauthorized adjacent hosts. The 128-byte disclosure per request is modest, but indefinite repetition enables memory harvesting. The integrity and availability baselines remain unaffected since the vulnerability does not provide direct code execution or denial-of-service capabilities.

Affected Systems:

• Mercusys AC12G (EU) V1 router
• Firmware version AC12G(EU)_V1_200909 (2020-09 build)
• Potentially other Mercusys router models sharing the same UPnP firmware component (unconfirmed due to limited vendor disclosure)

Blast Radius:

• Directly exposed hosts: any device on the same L2 broadcast domain as the router (all wired LAN clients and all Wi-Fi clients connected to the same SSID, including guest networks if configured without AP isolation).
• Secondary exposure: harvested credentials and configuration data can be repurposed for attacks against cloud services, corporate VPNs, or IoT devices that reuse the same credentials.
• The vulnerability does not affect internet-facing attack surface unless the router's UPnP port is exposed via port forwarding or the router is misconfigured to have UPnP reachable from the WAN.

Considerations:

• If a Wi-Fi admin password leaks, the attacker gains both network persistence and the ability to deny service to legitimate users by changing credentials.
• If the router administration credentials leak, the device becomes fully compromised — enabling full network traffic inspection (capable of seeing all unencrypted LAN traffic), DNS redirection, and botnet recruitment (router botnets are a known threat vector).
• The uninitialized memory could also contain fragments of other users' HTTP traffic that passed through the router's connection tracking table, creating a privacy breach for LAN users whose traffic traversed the affected device.

Detection Guidance

Detection of this vulnerability requires monitoring both network-level UPnP traffic and device-level memory access patterns. The following detection artifacts are relevant.

Sigma Rule

title: Mercusys AC12G UPnP Uninitialized Memory Disclosure Attempt
id: 7f3c9a2e-4b61-4d8a-9c5f-1a2b3c4d5e6f
status: experimental
description: >
  Detects HTTP POST requests to UPnP control endpoints on port 1900
  that lack the SOAPAction header, which triggers uninitialized memory
  disclosure (CVE-2026-36611) in Mercusys AC12G (EU) V1 firmware.
author: Valters IT Security Research
logsource:
  category: network_connection
  product: firewall
detection:
  selection_upnp_port:
    destination.port: 1900
  selection_method:
    http.method: 'POST'
  selection_soap_missing:
    http.soap_action: null  # header absent
  condition: selection_upnp_port and selection_method and selection_soap_missing
falsepositives:
  - Legitimate UPnP clients with broken/partial SOAP implementations
  - Network scanners that omit optional HTTP headers
level: medium
tags:
  - attack.t1190
  - cve.2026.36611
  - cwe.457
  - cwe.200

YARA Rule

rule CVE_2026_36611_Mercusys_AC12G_UPnP_MemDisclosure
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP POST packets without SOAPAction header targeting UPnP port 1900"
        cve = "CVE-2026-36611"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $post = "POST /" ascii
        $content_type = "Content-Type: text/xml" ascii nocase
        $upnp_urn = "urn:schemas-upnp-org" ascii nocase
        $soap_envelope = "soap:Envelope" ascii nocase
        $host_port = "Host: " ascii
        $port_1900 = ":1900" ascii
    condition:
        uint16(0) == 0x4854 and  // "HT" for HTTP
        $post and $content_type and $soap_envelope and $port_1900 and
        not contains($soapaction_header) and
        (contains($upnp_urn) or filesize > 150)
}

Suricata IDS Rule

alert tcp any any -> any 1900 (msg:"CVE-2026-36611 Mercusys AC12G UPnP Memory Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"text/xml"; http_client_body; content:"Envelope"; http_client_body; pcre:"/^Host\s*:\s*[^\r\n]*:1900/m"; flowbits:set,upnp_post_no_soap; content:"SOAPAction"; http_header; flowbits:noalert; flowbits:unset,upnp_post_no_soap; flowbits:isset,upnp_post_no_soap; metadata:created_at 2026-01-01, updated_at 2026-01-01, cve CVE-2026-36611; sid:100036611; rev:1;)

Elastic Detection

// EQL query for SIEM — detect UPnP POST requests missing SOAPAction
sequence by source.ip, destination.ip with maxspan=10s
  [network where destination.port == 1900 and network.direction == "outbound"]
  [http where http.request.method == "POST" 
     and not exists(http.request.headers.soap_action)
     and uri.path != "" and uri.path starts with "/"]

Splunk SPL Query

index=network sourcetype=stream:http
| where dest_port=1900 AND http_method="POST"
| eval has_soap=mvfind(http_headers, "(?i)^SOAPAction:")
| where isnull(has_soap)
| table _time, src_ip, dest_ip, dest_port, http_uri, http_headers
| sort _time
| stats count by src_ip, dest_ip
| where count > 5

Wazuh OSSEC Rule

<group name="cve-2026-36611,">
  <rule id="147527" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.module">suricata</field>
    <field name="alert.signature_id">100036611</field>
    <description>CVE-2026-36611: UPnP memory disclosure attempt against Mercusys AC12G</description>
    <group>upnp,memory_disclosure,cve-2026-36611,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. Vendor fix is N/A, and affected version lists are empty per provided data.

Immediate Mitigations (no vendor patch required):

1. Disable UPnP on the device: Log into the Mercusys AC12G admin panel (typically 192.168.1.1), navigate to Advanced Settings → Network → UPnP, and toggle it off. This immediately removes the vulnerable attack surface. Note that disabling UPnP may break features that rely on automatic port forwarding (P2P gaming, VoIP, IP camera access), requiring manual port forwarding configuration instead.

2. Enable Client Isolation (AP Isolation): In Wi-Fi settings, enable "AP Isolation" or "Client Isolation." This prevents connected wireless clients from communicating with one another at L2, blocking adjacent-network attackers from reaching the router's UPnP port. Be aware this may break network printing and screen mirroring between devices.

3. Segregate Guest Networks: Configure any guest Wi-Fi SSID on a separate VLAN or enable "Guest Network Isolation" to prevent guests from reaching the router admin interface and UPnP services.

4. Restrict LAN Access: Employ 802.1X authentication on wired switch ports where possible, or implement MAC address filtering (with awareness of MAC spoofing limitations).

5. Monitor UPnP Traffic: Deploy the detection rules above on the LAN segment to identify exploitation attempts.

Patch / Upgrade Steps:

1. Check Mercusys support website (https://www.mercusys.com/) for any firmware updates newer than v1_200909. The official support page for the AC12G (EU) model is the authoritative source for patched firmware.

2. If a patched firmware becomes available, download it, navigate to Administration → Firmware Upgrade in the router web console, and upload the binary. Preserve existing configuration by exporting settings prior to upgrade.

3. Subscribe to Mercusys security advisories (via their security page or firmware download notification system) to receive patch availability alerts.

4. If no patch is released within a reasonable timeframe (60–90 days), consider device replacement. Any consumer router with active vendor support and current firmware should be prioritized for procurement.

Long-Term Hardening:

1. Evaluate whether UPnP is genuinely required on the network. Many modern applications no longer rely on UPnP due to security concerns; manually configured port forwarding is more secure.

2. If replacement is unavoidable, evaluate alternatives from vendors with demonstrated security commitment. Candidates include routers from vendors with active PSIRT (Product Security Incident Response Team) processes.

3. Implement network segmentation. Place IoT devices and routers on a dedicated VLAN separate from critical business systems. Use a managed switch or router with VLAN support.

4. Establish a routine firmware update cadence (monthly check) for all network devices.

5. Consider integrating a purpose-built security appliance or network firewall that inspects UPnP traffic and enforces protocol validation, particularly for SOAPAction header presence.

6. Document this CVE in the organization's vulnerability register and schedule a follow-up review in 90 days to assess patch availability and exploit-wild data.

References

Based on available intelligence, no public references were provided in the CVE data package. The following authoritative references should be consulted for verification and ongoing monitoring:

1. NVD Entry for CVE-2026-36611: https://nvd.nist.gov/vuln/detail/CVE-2026-36611 — The canonical vulnerability database entry. Monitor for CVSS score publication and CWE classification updates.

2. Mercusys Official Support Portal: https://www.mercusys.com/support/ — The vendor's website for AC12G firmware downloads and potential security advisories. Verify periodically for patched firmware.

3. Mercusys AC12G Product Page: https://www.mercusys.com/en/product/details/AC12G — Confirms the affected product model and EU variant specifications.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — While this CVE is not currently listed, the catalog should be rechecked on a monthly basis to detect changes in exploit-in-the-wild status.

5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Relevant technique mapping for the adjoining-network exploitation vector.

At the time of writing, there is no evidence of active exploitation campaigns leveraging this vulnerability. The EPSS score of 0.00231 suggests low immediate exploitation likelihood. However, the absence of vendor remediation creates an enduring risk window. Organizations with affected Mercusys AC12G (EU) V1 devices on their premises (including home offices) should prioritize the mitigations outlined above and set a recurring review cadence to capture vendor patching announcements or disruptive changes in EPSS/KEV status.