CVE-2026-36612

Executive Summary

CVE-2026-36612 affects the Mercusys AC12G (EU) V1 dual-band wireless router, specifically firmware version AC12G(EU)_V1_200909. The vulnerability stems from the router's Wi-Fi Protected Setup (WPS) 2.0 feature being enabled by default with an insufficiently weak lockout policy — a mere 60-second lockout after 10 failed PIN authentication attempts. This weakness permits an unauthenticated, remote attacker within Wi-Fi range to perform an offline brute-force attack against the WPS PIN, recover the WPA/WPA2 pre-shared key, and gain full access to the protected wireless network. The impact is severe: complete compromise of network confidentiality, integrity, and availability for all devices connected to or relying upon this router.

Technical Analysis

Vulnerability Mechanism

The WPS 2.0 protocol, defined in Wi-Fi Alliance specifications, provides a mechanism for client devices to join a WPA/WPA2-protected network without manually entering the passphrase. The protocol supports two primary methods: Push Button Configuration (PBC) and PIN entry. The PIN method is susceptible to a well-documented design flaw: the protocol splits the 8-digit PIN into two halves. The first four digits (0000–9999) and the second half consisting of three digits and a single checksum digit. An attacker who can intercept EAP (Extensible Authentication Protocol) messages can attempt all 11,000 possible combinations (10,000 + 1,000) offline.

The standard protection against this online brute-force attack is a lockout mechanism: after a small number of failed PIN attempts (typically 3–5), the router should lock out WPS authentication for a prolonged period (e.g., 5 minutes or more). Mercusys AC12G (EU) V1, however, implements a 10-attempt threshold with only a 60-second lockout window. This is ineffective for two reasons:

1. High threshold: 10 attempts per lockout cycle allows testing of a significant subset of the 11,000 possible PINs, especially when combined with smart ordering techniques.
2. Short lockout: A 60-second lockout means the attacker can resume the attack almost immediately, sustaining a brute-force rate of approximately 10 PINs per ~70 seconds, or roughly 510 PINs per hour.

At this rate, the worst-case time to exhaust all 11,000 possible PINs is approximately 21.5 hours. With optimized PIN guessing strategies (using known WPS PIN generation weaknesses, e.g., default PIN patterns from the chipset vendor), the time-to-compromise can be reduced dramatically — often to under 4 hours. Real-world tools such as Reaver, Pixie Dust attack variants, and online brute-forcers can leverage this.

Attack Surface

The attack surface is the Wi-Fi radio interface. The attacker must be within wireless range of the target router (typically 50–100 meters indoors, up to several hundred meters outdoors with directional antennas). No prior authentication is required. The WPS PIN authentication process (EAP-WSC) is exposed over the 802.11 management and EAPOL frames.

Affected Configurations

• Product: Mercusys AC12G (EU) V1
• Firmware: AC12G(EU)_V1_200909 (build from September 2020)
• Default State: WPS 2.0 enabled, PIN method active, lockout set to 60 seconds after 10 failures.

Exploitation Scenarios

Attack Chain: WPS PIN Brute-Force with Weak Lockout

Step 1 — Reconnaissance (Target Identification) The attacker performs wardriving using standard Wi-Fi scanning tools (e.g., airmon-ng, airodump-ng, wash). The wash utility identifies networks with WPS enabled, their ESSID (e.g., "Mercusys_XXXX"), BSSID (MAC address), and WPS version. The attacker targets networks broadcasting SSIDs associated with Mercusys devices, or all networks showing WPS 2.0 active.

Step 2 — WPS PIN Enumeration and Trigger Using a tool like Reaver or bully, the attacker initiates a WPS PIN authentication session:

# Put wireless card in monitor mode
airmon-ng start wlan0

# Scan for WPS-enabled networks
wash -i mon0

# Begin PIN brute-force
reaver -i mon0 -b <BSSID> -c <channel> -vv

Reaver begins sending EAP-WSC START messages followed by M1/M2 handshake exchanges. It sends a PIN (starting with the first 4-digit half), receives an M3/M4 message indicating success/failure from the target. If the PIN is incorrect, the router increments a counter. Reaver cycles through PIN combinations, sending one PIN attempt every few seconds to stay under the lockout threshold.

Step 3 — Lockout Evasion After 10 failed attempts, the router enters lockout mode, rejecting all further WPS attempts for 60 seconds. The attacker calibrates the brute-force to pause for 65 seconds after every 10 attempts. This minimizes detection while maintaining a steady state of ~510 PINs/hour. More sophisticated tooling can send the 11th attempt at exactly the 60th second, reducing idle time. The total time to exhaust all 11,000 PINs is approximately 22 hours; with default PIN pattern sequences, this can be reduced significantly.

Step 4 — Successful Authentication and PSK Recovery Once the correct PIN (e.g., 12345670) is discovered, the router responds with the WPA/WPA2 pre-shared key (PSK) in an encrypted M7/M8 message exchange. Reaver extracts this and outputs:

[+] WPA PSK: 'MySecretPassphrase123'
[+] AP SSID: 'Mercusys_Network'

Step 5 — Post-Exploitation The attacker now possesses the PSK. They can:

• Connect to the Wi-Fi network without generating further alerts.
• Perform ARP spoofing and MITM attacks on connected clients.
• Access the router's LAN-side administrative web interface (typically 192.168.1.1 or 192.168.0.1). The default admin credentials are admin/admin; if unchanged, the attacker gains full router control (DNS hijacking, traffic sniffing, firmware modification).
• Pivot to attack other internal hosts on the network.

Alternative Accelerated Path — Pixie Dust If the router uses a Broadcom or Realtek chipset with predictable E-S1 and E-S2 nonces (pseudorandom generator seeded with known values), the attacker runs the Pixie Dust attack (reaver -K 1 or pixiewps). This completely bypasses the online lockout, retrieving the PIN in seconds. This is highly plausible given the router's age (2020 firmware) and budget-market positioning.

Impact Assessment

CVSS v3.1 Rationale (score not officially assigned): The vulnerability allows network-byte-level access to the WPS PIN interface without authentication. Under the CVSS v3.1 framework this maps to: AV:N (adjacent network — Wi-Fi range), AC:L, PR:N, UI:N, and C:H/I:H/A:H — yielding a score of 9.8 (Critical). The NVD has not published a CVSS vector; this assessment is provided for risk-scoring purposes only.

Business Impact:

• Confidentiality: Complete loss — an attacker decrypts all WPA2 traffic on the network, including HTTP, DNS, and potentially internal application traffic.
• Integrity: An attacker can alter DNS responses, inject malicious content, redirect traffic, or modify router settings (DNS servers, port forwarding) to facilitate further compromise.
• Availability: An attacker can perform deauthentication attacks, bandwidth saturation, or completely lock the router via repeated failed admin logins or firmware bricking.
• Deployment Footprint: The AC12G is a budget dual-band AC1200 router sold primarily in Europe. It is used in SOHO environments, small retail shops, and residential networks. While not an enterprise-grade device, compromised SOHO routers are frequently leveraged as proxies, VPN endpoints, or for credential theft targeting home-office VPN gateways.

Blast Radius: Any network segment behind the router is exposed. This includes IoT devices, NAS storage, cameras, and any corporate BYOD devices connected to home networks. Lateral movement from a compromised router to corporate infrastructure is possible if VPN tunnels terminate on the same LAN.

EPSS Context: EPSS score 0.00139 (3.7th percentile) indicates low probability of exploitation in the wild within the next 30 days. However, the low score reflects general CVE-exploitation statistics, not the technical feasibility — the vulnerability is highly practical to exploit with commodity tools.

Detection Guidance

Sigma Rule

title: WPS PIN Brute-Force - Multiple Authentication Failures
id: 3f7c9d2e-4a2b-4e8a-9b6c-1f2d3e4a5b6c
status: experimental
description: >
  Detects multiple WPS authentication failure events from the same source MAC
  within a short window, indicating a potential brute-force attack against WPS PIN.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-36612
author: ValtersIt Threat Intelligence
date: 2026/07/14
logsource:
  product: wazuh
  category: wifi
  definition: 'Wazuh or syslog-based Wi-Fi access point logs via RFC 5424 or WAPI'
detection:
  selection:
    event_type: 'WPS_AUTH_FAIL'
    source_mac:
      - '*'
  condition: selection
  timeframe: 5m
  threshold: 10
falsepositives:
  - Legitimate user entering incorrect PIN multiple times (unlikely > 10)
  - Misconfigured client devices repeatedly attempting to join
level: high
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2026.36612

YARA Rule

rule CVE_2026_36612_WPS_PIN_BRUTEFORCE_FRAMES
{
    meta:
        author = "ValtersIt Threat Intelligence"
        description = "Detects WPS EAPOL frames exhibiting rapid sequential PIN attempt patterns"
        date = "2026-07-14"
        cve = "CVE-2026-36612"
    strings:
        // EAPOL over 802.11 - EAP-WSC Authentication Request (Type 01, WPS opcode 0x04)
        $wps_frame_header = { 88 02 }  // EAPOL key descriptor offset
        $eap_wsc_oui = { 00 50 F2 04 01 }  // WFA OUI + EAP-WSC type
        // PIN length indicators (M2 message with full 8-digit PIN)
        $attr_pin = { 10 2E 00 08 }  // WPS PIN attribute (0x102E, length 8)
        $attr_version2 = { 10 4A 00 01 10 } // WPS Version2 attribute
        $req_type = { 10 3A 00 01 01 }  // Request Type: Enrollee
    condition:
        any of them
}

Suricata IDS Rule

alert wlan any any -> any any (msg:"CVE-2026-36612 Mercusys AC12G WPS PIN Brute-Force"; \
flow:to_server; \
wlan_frame_type: mgmt; \
wlan_frame_subtype: action; \
content:"|00 50 F2 04 01|"; offset:4; depth:6; \
content:"|10 2E 00 08|"; distance:4; within:12; \
threshold: type both, track by_src, count 10, seconds 70; \
metadata: created_at 2026_07_14, updated_at 2026_07_14, \
cve CVE-2026-36612; \
reference: url,nvd.nist.gov/vuln/detail/CVE-2026-36612; \
classtype:attempted-dos; sid: 80200101; rev:1;)

Elastic Detection

# EQL - Search for >= 10 WPS auth failures from same source MAC in a 5-minute bucket
any where event.category == "wifi" and event.type == "auth" and event.action == "wps_failure" and source.mac != null
| stats count_wps_failures = count() by source.mac
| where count_wps_failures >= 10

Splunk SPL Query

index=wifi sourcetype="mercusys:syslog" "WPS" "FAIL" 
| bin _time span=5m
| stats count AS wps_failures BY _time, srcMac
| where wps_failures >= 10
| table _time, srcMac, wps_failures
| sort - wps_failures

Wazuh OSSEC Rule

<group name="wps_bruteforce,">
    <rule id="802001" level="10">
        <if_sid>570, 571</if_sid>
        <match>^WPS.*(FAIL|ERROR|invalid PIN)</match>
        <description>WPS authentication failure detected - possible brute-force</description>
        <group>authentication_failed,attack,wifi,</group>
        <options>no_full_log</options>
    </rule>
    <rule id="802002" level="12">
        <if_sid>802001</if_sid>
        <frequency>10</frequency>
        <timeframe>300</timeframe>
        <same_source_ip/>
        <description>Multiple WPS failures from same source - CVE-2026-36612 WPS brute-force attempt</description>
        <group>attack.recon,attack.t1190,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Immediate Mitigations (no vendor patch available — patch confidence: 0/4)

1. Disable WPS entirely — Access the router's web admin interface (http://192.168.1.1/ or 192.168.0.1), navigate to Wireless Settings → WPS, and set the toggle to Disabled. This entirely removes the attack surface and is the single most effective immediate action.
2. If WPS must remain enabled for legacy devices, use PBC (Push Button Configuration) exclusively and disable PIN entry. This requires physical access to the router for each new device pairing, eliminating the remote brute-force vector.
3. Change the Wi-Fi passphrase — Even with WPS disabled, change the PSK if any suspicion of prior WPS compromise exists (e.g., WPS was exposed for extended periods, or suspicious MAC addresses seen in logs). Use a strong, unique passphrase (≥ 20 characters).
4. Restrict SSID visibility — Disable SSID broadcasting to lower the detection profile, though hiding SSIDs is security-through-obscurity and not a robust defense.
5. Monitor WPS events — If the router supports logging (via syslog to Wazuh/Splunk), enable logging of WPS authentication attempts and alert on > 5 failures per source MAC.

Patch/Upgrade Steps

• Vendor advisory: Mercusys has not released a firmware update patching this CVE as of the publication date. Check the Mercusys official support site (mercusys.com) monthly for the latest AC12G EU V1 firmware.
• Hardware replacement: Given the absence of a patch and the vendor's historical slow response for budget devices, consider replacing the AC12G with a router that allows full WPS isolation, or migrate to a different vendor's device with modern WPA3 support (which deprecates WPS PIN), such as models from TP-Link (Archer series), Asus, or Ubiquiti.

Long-Term Hardening

• Transition to WPA3 (SAE) — Replace or upgrade hardware to support WPA3, which eliminates WPS PIN vulnerabilities entirely (WPS PIN is not supported in WPA3-Personal mode).
• Network segmentation — Place IoT and guest devices on a segregated VLAN/subnet that lacks access to sensitive systems. Even if the router's Wi-Fi is compromised, the blast radius is contained.
• Firmware update policy — Establish a routine (quarterly) check for router firmware updates from the vendor. For SOHO routers, consider a 3-year refresh cycle.
• Wireless intrusion detection — Deploy a lightweight WIDS (e.g., using a Raspberry Pi with aircrack-ng suite in monitor mode) to alert on excessive WPS failure rates.

References

1. NVD — CVE-2026-36612: https://nvd.nist.gov/vuln/detail/CVE-2026-36612
2. Mercusys Official Support (AC12G downloads): https://www.mercusys.com/en/support/download — Monitor for firmware updates.
3. Wi-Fi Alliance — WPS 2.0 Specification: https://www.wi-fi.org/file/wi-fi-simple-configuration-specification — For protocol details underlying PIN brute-force.
4. Reaver-WPS (tool): [https://github.com/t6x/reaver-wps-fork (returned 404 — verify manually)](https://github.com/t6x/reaver-wps-fork (returned 404 — verify manually)) — Reference tool for WPS PIN brute-force.
5. CISA KEV: No record — CVE-2026-36612 is not listed on the Known Exploited Vulnerabilities Catalog as of publication.

Known Campaigns / Exploit-in-the-Wild: As of this writing, there are no confirmed reports of mass exploitation of this CVE in the wild. However, WPS PIN brute-force techniques are commodity skills among residential and small-business network attackers. The 60-second lockout provides only minimal deterrence for a determined attacker; an automated tool can sustain a brute-force campaign for < 24 hours and likely succeed. Given the router's deployment in SOHO environments with weak default PSK policies, risk of compromise remains elevated even with a low EPSS score.