CVE-2026-36613

Executive Summary

CVE-2026-36613 is an information disclosure vulnerability affecting the Mercusys AC12G (EU) V1 wireless router, specifically firmware version AC12G(EU)_V1_200909. When an unauthenticated attacker sends HTTP POST requests to undefined (non-existent) URI paths on the device's management interface, the router returns 128 bytes of uninitialized internal buffer contents, leaking sensitive data from kernel memory, heap allocations, or stale network stack state. The vulnerability requires only adjacent network access — the attacker must be on the same LAN or wireless network as the target device. The leaked data may expose stack canaries, memory addresses useful for ROP chain construction, DHCP lease information, MAC address tables, or remnants of previously processed HTTP requests from legitimate administrators. With no CVSS score assigned and an EPSS probability of 0.00159 (5.5th percentile), this is currently a low-probability, unpatched flaw that nonetheless poses a meaningful risk to enterprise edge networks using this consumer-grade router model.

Technical Analysis

The vulnerability resides in the HTTP server implementation embedded within the Mercusys AC12G (EU) V1 firmware, version AC12G(EU)_V1_200909. The affected router firmware is built atop a lightweight embedded web server (commonly a variant of mini_httpd, uhttpd, or a vendor-customized HTTP stack derived from Broadcom/MediaTek reference code). The flaw is triggered when the HTTP server receives a POST request targeting a URI that does not correspond to any registered handler or CGI endpoint.

Mechanism: When the web server dispatches an incoming HTTP request, it performs URI-to-handler matching. For undefined paths, the server falls into a default error-handling routine. This routine allocates a response buffer on the stack or heap without prior initialization. Under normal conditions, the server would populate this buffer with an HTTP 404 error page. However, due to a logic flaw in firmware version 200909, the error handler copies only a portion of the pre-allocated buffer to the client response, then sends the remaining 128 bytes of uninitialized data directly over the socket without zeroing or sanitizing the buffer first. The uninitialized region contains whatever data was previously resident at that memory location — potentially including:

• Fragments of previously handled HTTP requests (headers, cookies, POST bodies from admin sessions)
• Kernel network stack buffers (TCP sequence numbers, packet payloads from other hosts on the LAN)
• DHCP client state (lease information, DNS server IPs, gateway addresses)
• Heap metadata (malloc chunk headers, free list pointers) useful for heap exploitation
• Hash table entries from the ARP cache or MAC address forwarding table
• Random stack garbage including return addresses or frame pointers useful for ASLR bypass

The 128-byte disclosure size is significant: it allows an attacker to leak enough contiguous memory to (a) identify the exact firmware build and memory layout, (b) extract credential material if a prior admin POST contained form data in the same memory region, or (c) defeat ASLR by leaking a stack or heap address usable in a follow-up RCE chain.

Attack surface: The management web interface listens on TCP port 80 by default (and optionally 443 with HTTPS). No authentication is required to trigger the flaw — the vulnerability is reachable pre-authentication. However, network access is restricted to the LAN/WLAN segment because the router's management interface is not typically exposed to the WAN side unless UPnP port forwarding or DMZ is misconfigured. The attack requires the ability to craft raw HTTP requests, which can be performed with curl, netcat, Burp Suite, or a custom Python script.

Exploitation Scenarios

Scenario 1: Credential Harvesting via Buffer Memory Leak

1. Reconnaissance/target identification: The attacker performs an ARP scan (e.g., arp-scan -l) or uses Nmap (nmap -sn 192.168.1.0/24) to identify live hosts. The Mercusys AC12G responds to SNMP (UDP 161), mDNS, and has a distinctive default SSID (e.g., "MERCUSYS_XXXX"). Fingerprint the device by connecting to port 80 and inspecting the Server: header or the login page HTML title (http.title:"Mercusys").

2. Trigger/weaponization: The attacker sends a crafted HTTP POST request to an undefined path, ensuring the request body contains decoy data designed to occupy the same memory region the server will later leak. Example using curl:

   curl -X POST http://192.168.1.1/undefined_endpoint_xyz \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -d "username=admin&password=LetMeIn123&token=4f6a2b9c" \
        --http1.1 --output response.bin
   

   The request body (username=admin&password=LetMeIn123) is parsed by the HTTP server's form-handling code, which stores a copy in the heap region adjacent to the error handler's response buffer.

3. Payload/execution: The server responds with an HTTP status line (likely 404) followed by the 128-byte leaked buffer. The attacker examines the response:

   xxd response.bin | head -20
   

   If the leak contains remnants of the POST body (because the uninitialized buffer overlaps with the heap region that held the parsed form data), the attacker recovers the plaintext password.

4. Post-exploitation impact: With admin credentials, the attacker logs into the router's web interface, disables firewall rules, enables SSH or telnet (if supported), sets up port forwarding to an internal host, or modifies DNS settings to redirect traffic to attacker-controlled servers.

Scenario 2: ASLR Bypass → RCE Chain (Advanced)

1. Reconnaissance: Attacker identifies the router model and firmware version via the login page footer (AC12G (EU) V1_200909).

2. Buffer leak: Attacker sends repeated POST requests to random undefined paths (e.g., /aaa, /bbb, /ccc) and collates the leaked 128-byte chunks. By sending 50-100 requests, they map out the memory layout and identify stack/heap pointer values. The leak reveals a heap address (0x80xxxxx) that bypasses ASLR for the subsequent exploit stage.

3. Weaponization: Using the leaked heap pointer, the attacker crafts a buffer-overflow exploit targeting a known vulnerable CGI handler (e.g., the ping utility at /cgi-bin/ping with an oversized hostname parameter). The overflow overwrites the return address with a ROP chain anchored at the leaked heap address, redirecting execution to a MIPS shellcode stub that opens a reverse shell to the attacker's machine.

4. Post-exploitation: The attacker gains root shell on the router, captures all LAN traffic via tcpdump, modifies routing tables, or pivots into the internal network.

Scenario 3: LAN-Wide Reconnaissance via DHCP/MAC Leak

1. Reconnaissance: Attacker on the WLAN runs airodump-ng to enumerate connected clients, then targets the router.

2. Leak collection: Attacker sends POST requests and inspects leaked bytes for MAC address entries, DHCP client lease tables, and ARP cache data. The leaked information reveals the internal network topology — IP addresses of all connected devices, their MAC addresses (enabling vendor fingerprinting), and DNS server IPs.

3. Post-exploitation: The attacker identifies a Windows domain controller, a printer, or an IoT camera on the LAN, then targets those hosts directly with known exploits, using the router's leaked network map to plan the attack path.

Note: This vulnerability is exploitable only from the LAN/WLAN side — it is not directly reachable from the WAN unless the router's management port is exposed via port forwarding. The attack does not require authentication.

Impact Assessment

Business impact: The Mercusys AC12G is a consumer/SOHO router commonly deployed in home offices, small branch offices, and as temporary access points in enterprise environments. For an enterprise, a compromised or leaking router of this type can expose:

• Administrative credentials for the router itself, enabling full device takeover
• Network topology data (MAC addresses, DHCP leases) that aids lateral movement
• Session tokens or cookies from admin HTTP sessions if the admin uses the web UI while the attacker is on the same network
• Memory pointers (stack/heap addresses) that reduce the difficulty of a follow-up RCE exploit

Affected systems: All Mercusys AC12G (EU) units running firmware AC12G(EU)_V1_200909. The "EU" suffix indicates the European SKU; other regional variants (US, APAC) may or may not be affected depending on shared codebase. The NVD description specifies only the EU_V1 hardware revision.

Blast radius: Because the vulnerability is limited to adjacent network access, the immediate blast radius is confined to the LAN/WLAN segment served by the router. However, the information leaked can enable further attacks against hosts on that segment. In a multi-tenant building (apartment complex, co-working space, hotel), an attacker on the same Wi-Fi network as the router could harvest credentials and map the network. The CVSS score is N/A (unassigned), but based on the attack vector (adjacent), attack complexity (low), privileges required (none), user interaction (none), and impact (confidentiality: high, integrity: none, availability: none), a reasonable CVSS 3.1 estimate would be Medium (6.5).

Detection Guidance

Sigma Rule

title: Mercusys AC12G Uninitialized Buffer Leak via POST to Undefined Path
id: 9b7d7e2f-4c1a-4b8e-9f3d-2c5a6b7c8d9e
status: experimental
description: Detects HTTP POST requests to non-existent URI paths on Mercusys AC12G routers, which triggers a 128-byte uninitialized buffer leak.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36613
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: mercusys
detection:
    selection:
        cs-method: POST
        http.response.status_code: 404
        c-uri|endswith:
            - '*.undefined*'
            - '*.nonexistent*'
            - '*.test*'   # common placeholder paths used by scanners
    condition: selection
fields:
    - c-uri
    - src_ip
    - dst_ip
    - http.user_agent
falsepositives:
    - Legitimate firmware update checks or diagnostic tools hitting undefined paths
    - Generic vulnerability scanners (Nikto, Nuclei) probing unknown endpoints
level: medium
tags:
    - attack.t1190
    - cve.2026-36613
    - info_disclosure

YARA Rule

rule Mercusys_AC12G_BufferLeak_Response
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects response patterns characteristic of CVE-2026-36613 uninitialized buffer leaks from Mercusys AC12G"
        cve = "CVE-2026-36613"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36613"

    strings:
        // HTTP 404 response with unusual body size (128 bytes of uninitialized data)
        $http_404 = "HTTP/1.1 404" ascii wide
        $http_404_alt = "HTTP/1.0 404" ascii wide

        // Mercusys server banner (common variants)
        $server_banner = "Server: " ascii wide
        $merc_server1 = "MERCUSYS" ascii wide
        $merc_server2 = "mercusys" ascii wide
        $merc_server3 = "OpenWrt" ascii wide  // if firmware based on OpenWrt

        // Response body patterns: high entropy, non-HTML, binary garbage
        $non_html = { 00 00 00 00 } // null bytes unlikely in valid HTML error pages
        $binary_marker = { FF D8 }  // JPEG magic bytes if image data leaked
        $mac_pattern = /([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}/ // MAC address leak

    condition:
        uint16(0) == 0x4854 and // "HT"
        (
            $http_404 or $http_404_alt
        ) and
        filesize >= 200 and filesize <= 400 and // 404 page + ~128 bytes leak
        (
            $server_banner or $merc_server1 or $merc_server2 or $merc_server3
        ) and
        (
            $non_html or $binary_marker or $mac_pattern
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-36613 Mercusys AC12G Uninitialized Buffer Leak Attempt"; sid:202636613; rev:1; classtype:attempted-recon; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-36613, attack_target router, deployment perimeter, signature_severity Major, tag info_disclosure; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/"; http.uri; content:!"/cgi-bin"; http.uri; content:!"/login"; http.uri; content:!"/index.html"; http.uri; content:!"/cgi/"; http.header; content:"Host"; pcre:"/^POST\s+\/[a-zA-Z0-9_\-]{8,}\s+HTTP\/1\.[01]\r\nHost:\s+[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/"; threshold:type both, track by_src, count 5, seconds 60; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-36613; priority:2;)

Explanation: This rule triggers when an HTTP POST request is sent to a non-CGI, non-login path with a hostname of at least 8 alphanumeric characters, repeated from the same source IP at least 5 times in 60 seconds. The threshold suppresses single benign requests while catching systematic probing behavior indicative of exploitation.

Elastic Detection

// EQL query for Elastic Security
sequence with maxspan=60s
  [ network where event.category == "network" and network.protocol == "http"
    and http.request.method == "POST"
    and (http.request.uri endsWith "undefined" or http.request.uri endsWith "/test" or
         http.request.uri == "/abc" or http.request.uri == "/xyz")
    and destination.port == 80 ]
  [ network where event.category == "network" and network.protocol == "http"
    and http.response.status_code == 404
    and http.response.body.bytes >= 128
    and http.response.body.bytes <= 512
    and destination.port == 80 ]
  | count(source.ip) >= 5

Note: Use the EQL sequence above with a count filter. In Elasticsearch with Elastic Security, ensure the http.request.uri field is properly indexed from your network pipeline (e.g., Zeek or Packetbeat).

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=pan:traffic
| where "http.request.method"="POST"
| where "http.request.uri" NOT IN ("/cgi-bin/*", "/login", "/index.html", "/cgi/*")
| where "http.request.uri" LIKE "%undefined%" OR "http.request.uri" LIKE "%test%" OR len("http.request.uri") > 20
| stats count by src_ip, dest_ip, http.request.uri
| where count >= 5
| eval threat = "CVE-2026-36613 Mercusys AC12G buffer leak probe"
| table _time, src_ip, dest_ip, http.request.uri, count
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-36613,">
  <rule id="100366" level="8" frequency="5" timeframe="60">
    <if_matched_sid>100365</if_matched_sid>
    <description>Mercusys AC12G CVE-2026-36613: Repeated HTTP POST to undefined paths (uninitialized buffer leak)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <var name="urgency">70</var>
    <var name="alert">info_disclosure_attempt</var>
    <options>no_full_log</options>
  </rule>

  <rule id="100365" level="4" frequency="1">
    <if_sid>100350</if_sid>  <!-- Apache/IIS catch-all: HTTP POST -->
    <description>Mercusys AC12G: HTTP POST to undefined path detected</description>
    <group>attack.t1190,</group>
    <match>POST</match>
    <regex>POST\s+/(?!cgi-bin|login|index\.html|cgi)[^\s]*HTTP/1\.[01]</regex>
    <options>no_full_log</options>
  </rule>
</group>

Placement: Add to /var/ossec/etc/rules/local_rules.xml. The parent rule (100350) should be an existing catch-all that matches HTTP POST lines in the Apache or Nginx log decoder.

Wazuh OSSEC FIM Rule (Alternative — Detects Modified firmware)

<group name="cve-2026-36613-firmware,">
  <rule id="100367" level="7" frequency="1">
    <if_sid>554</if_sid>  <!-- File integrity check -->
    <description>Mercusys AC12G: Detected potential firmware modification (CVE-2026-36613 exploitation indicator)</description>
    <match>/etc/mosquitto/</match>  <!-- Example: checksum mismatch in system dirs -->
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor (Mercusys) has not released a firmware update to address CVE-2026-36613 as of the writing of this report. Affected firmware version: AC12G(EU)_V1_200909.

Immediate mitigations (compensating controls):

1. Restrict management access: If the router's web UI must remain enabled, restrict access to a dedicated VLAN that excludes untrusted hosts. Configure access control lists (ACLs) on the upstream switch/firewall to allow only specific management IPs to reach TCP port 80/443 on the router.
2. Disable remote management: Ensure the router's "Remote Management" or "Access from WAN" setting is disabled. This prevents WAN-side exploitation if the router is inadvertently exposed.
3. Network segmentation: Place the Mercusys AC12G on an isolated IoT/branch segment, separate from critical enterprise assets. Use VLAN segregation so that even if the router is compromised, lateral movement is limited.
4. Monitor for anomalous HTTP traffic: Deploy the detection rules above (Sigma/Suricata/Splunk) at the network edge or on the segment hosting the router. Watch for repeated POSTs to non-existent paths.
5. Replace the device: Given that this is a consumer-grade router in an enterprise context, the most robust mitigation is to replace the AC12G with an enterprise-grade access point/router (e.g., Cisco, Fortinet, Ubiquiti UniFi) that receives regular firmware security patches.

Patch/upgrade steps (when available):

1. Monitor Mercusys official support page (https://www.mercusys.com/en/support/) and the product page for the AC12G for firmware releases. Check the firmware version string against AC12G(EU)_V1_200909; any version higher than 200909 should be evaluated for this fix.
2. Download the updated firmware, log into the router's web UI, navigate to System Tools → Firmware Upgrade, upload the .bin file, and reboot.
3. After upgrade, verify the firmware version via the status page. Re-test the vulnerability by sending a POST to an undefined path and confirming the response body is empty (or a standard 404 error page) with no 128-byte leak.

Long-term hardening:

1. Firmware update policy: Establish a quarterly review of all embedded devices, including SOHO routers, for firmware updates and CVE exposure. Subscribe to NVD CVE feeds and vendor security advisories.
2. Deprecate consumer-grade networking equipment in enterprise environments. These devices lack public, regular security patch cycles and have limited EOL support.
3. Enable logging and alerting: Configure the upstream firewall to log all traffic to port 80/443 on the router's IP. Forward these logs to the SIEM.
4. Use WPA2/WPA3 with strong PSK if the router is used as a wireless access point, and change default admin credentials immediately.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36613
2. Mercusys Official Support (firmware downloads): https://www.mercusys.com/en/support/download/
3. Mercusys AC12G Product Page: https://www.mercusys.com/en/networking/wifi-router/ac12g/
4. CISA Known Exploited Vulnerabilities (KEV) Catalog: [No entry found — CVE-2026-36613 is NOT in the KEV catalog]
5. FIRST EPSS Calculator (for CVE-2026-36613): https://www.first.org/epss/search?q=CVE-2026-36613

Threat actor activity: As of this report, there is no evidence of in-the-wild exploitation or documented threat actor campaigns targeting this specific CVE. The EPSS score (0.00159, 5.5th percentile) indicates a very low probability of exploitation in the near term. However, the vulnerability class (uninitialized buffer disclosure in embedded web servers) has been actively exploited in other devices (e.g., similar flaws in D-Link and TP-Link firmware), so monitoring should continue.