CVE-2026-36615

Executive Summary

CVE-2026-36615 discloses an undocumented /agileconfigreset endpoint on the Mercusys AC12G (EU) V1 wireless router (firmware AC12G(EU)_V1_200909) that returns internal buffer contents to unauthenticated attackers on the adjacent network. This memory disclosure flaw allows a network-adjacent attacker to exfiltrate sensitive data from device memory, potentially including configuration credentials, session tokens, or routing data. The vendor has not released a patch as of this report, and no public exploit code exists, though the EPSS score of 0.00166 (6.2% percentile) indicates low current exploitation likelihood.

Technical Analysis

The vulnerability resides in an undocumented handler mapped to the /agileconfigreset URI on the Mercusys AC12G (EU) V1 device. This endpoint is not part of the standard administrative web interface and is not referenced in any vendor documentation. Analysis of the firmware (AC12G(EU)_V1_200909) suggests the endpoint implements a debugging or factory-reset helper routine that invokes a memory dump function, returning raw buffer contents in the HTTP response body.

The underlying mechanism is a classic information disclosure flaw: the handler fails to sanitize or bound the memory region it returns. Instead of returning a fixed-size status message (e.g., a "reset successful" string), the endpoint returns a length-prefixed or delimited buffer containing whatever data resides at the relevant memory address. This can include:

• Configuration file contents — plaintext Wi-Fi PSKs, admin password hashes, ISP PPPoE credentials.
• Session tokens — active login cookies or management session identifiers for the web UI.
• Network state — ARP table entries, DHCP lease data, or routing tables.
• Kernel/RTOS remnants — leftover heap or stack data from prior operations.

The attack surface is the device's HTTP management interface (typically port 80 or 8080). Because the endpoint requires no authentication and no CSRF token, any unauthenticated party with network access to the device's LAN/WLAN interface can trigger it. The phrase "adjacent network" in the NVD description indicates the endpoint is bound to the LAN-side interface and is not reachable from the WAN (internet-facing) side without prior network traversal.

The vulnerability class maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The endpoint's undocumented nature also introduces a security-by-obscurity failure — the handler was likely intended for factory diagnostics but was left enabled in production firmware.

Attack surface summary:

• Interface: LAN/WLAN HTTP management interface (port 80/8080).
• Authentication: None required.
• Precondition: Attacker must be on the same L2 network segment (Wi-Fi or wired LAN) as the router.
• Impact: Full memory disclosure leading to credential theft and potential full device compromise.

Exploitation Scenarios

Scenario 1 — Wi-Fi Credential Theft via Crafted HTTP Request

1. Reconnaissance: The attacker connects to the target network (e.g., a compromised guest Wi-Fi, a rogue device on a corporate LAN, or a neighbor's open network). They scan the local subnet for IPs with open port 80/8080 using nmap -p 80,8080 192.168.1.0/24.
2. Trigger: The attacker sends a single unauthenticated HTTP GET request to the undocumented endpoint:

   curl -v http://192.168.1.1:80/agileconfigreset
   

   Alternatively, they use a raw socket:

   printf 'GET /agileconfigreset HTTP/1.1\r\nHost: 192.168.1.1\r\nConnection: close\r\n\r\n' | nc 192.168.1.1 80
   

3. Payload/Execution: The device responds with HTTP/1.1 200 OK and a body containing raw memory contents. The attacker captures the response and saves it to a file for offline parsing. The response may be binary or ASCII; the attacker runs strings on the captured data:

   curl -s http://192.168.1.1/agileconfigreset | strings > memory_dump.txt
   grep -iE "SSID|WPA|PSK|password|admin" memory_dump.txt
   

4. Post-Exploitation: The attacker extracts the Wi-Fi pre-shared key and the admin panel credentials. They connect to the Wi-Fi network as a legitimate user and authenticate to the router's admin panel, where they can change DNS settings to redirect traffic, disable security features, or install malicious firmware.

Scenario 2 — Network Pivot and Lateral Movement

1. Reconnaissance: An attacker who has already compromised an IoT device on the LAN (e.g., a smart TV) uses it as a pivot to reach the router's management interface at 192.168.1.1.
2. Trigger & Extraction: Using a single curl command from the compromised device, the attacker dumps the router's memory buffer:

   curl -s http://192.168.1.1/agileconfigreset -o /tmp/router_dump.bin
   

3. Credential Harvest: The attacker parses the dump for VPN credentials, LDAP bind passwords, or router-generated tokens that are cached in memory from intercepted traffic.
4. Post-Exploitation: With router admin access, the attacker configures the router to forward all traffic to a malicious proxy, enabling man-in-the-middle interception of the entire network's traffic, including TLS termination if the router supports SSL inspection.

Scenario 3 — Token Replay for Admin Session Hijacking

1. Reconnaissance: The attacker observes that a legitimate admin is actively using the router's web interface. They note the admin's source IP.
2. Trigger: The attacker sends the GET /agileconfigreset request and captures the memory dump. Within the dump, they locate active session cookie values or CSRF tokens that match the admin's current session.
3. Replay: The attacker uses these captured tokens to forge authenticated requests to the router's web UI, performing actions as the admin (changing firewall rules, adding a backdoor port-forward).
4. Post-Exploitation: The attacker establishes persistent remote access by adding a port-forwarding rule from the WAN to an internal command shell service, bypassing the adjacent-network restriction permanently.

Impact Assessment

Business Impact (High): This vulnerability enables unauthenticated disclosure of sensitive device state on any Mercusys AC12G (EU) V1 router in use. For enterprise environments using these consumer-grade devices as access points in remote sites or small branch offices, this means:

• Credential compromise: Wi-Fi PSKs and admin passwords for the router itself are exposed, allowing full takeover.
• Lateral movement: Any network credentials stored in device memory (e.g., PPPoE, VPN, or captive portal credentials) are leaked, enabling the attacker to expand into the broader corporate network.
• Regulatory exposure: If the router manages traffic for regulated environments (e.g., payment systems, health data), credential disclosure may trigger breach-reporting obligations under GDPR, PCI-DSS, or HIPAA.

Affected Systems: All Mercusys AC12G (EU) V1 units running firmware AC12G(EU)_V1_200909. The "EU" variant indicates this is specifically the European-market release; other regional variants (US, AU) may share the same codebase but are not confirmed affected.

Blast Radius: Network-adjacent attackers who can reach the LAN interface. This includes:

• Guests on a guest Wi-Fi network that is incorrectly firewalled.
• Compromised IoT devices on the LAN.
• Wireless clients within signal range if WPA is not enforced (open or WEP networks).

CVSS Context: The official CVSS score is listed as N/A. A reasonable derived score would be approximately CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 6.5 (Medium), reflecting the high confidentiality impact but limited availability/integrity impact and the adjacent-network attack vector.

Detection Guidance

Sigma Rule

title: Mercusys AC12G Undocumented AgileConfigReset Endpoint Access
id: 8f2b1c6e-3f4d-4a9e-8b2c-1d5e6f7a8b90
status: experimental
description: Detects unauthenticated HTTP requests to the /agileconfigreset endpoint on Mercusys AC12G routers, indicating potential exploitation of CVE-2026-36615.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36615
author: Valtersit Threat Intel
date: 2026/05/01
logsource:
    category: webserver
    product: mercusys
detection:
    selection:
        cs-method: 'GET'
        cs-uri-path:
            - '/agileconfigreset'
            - '/agileconfigreset/'
            - '/agileconfigreset?*'
    condition: selection
fields:
    - clientip
    - cs-uri-path
    - cs-method
falsepositives:
    - Legitimate assistance from vendor support using undocumented debug endpoints
level: high

YARA Rule

rule Mercusys_AC12G_AgileConfigReset_C2E_2026_36615
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTTP requests targeting the undocumented /agileconfigreset endpoint on Mercusys AC12G routers"
        date = "2026-07-01"
        cve = "CVE-2026-36615"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36615"
        severity = "high"
    strings:
        $uri_pattern = /GET \/agileconfigreset[\/\s?]/
        $host_header = "Host:" nocase
        $user_agent_common = "curl" nocase
        $user_agent_nc = "netcat" nocase
        $http_version = "HTTP/1.1"
        $response_header = "200 OK"
    condition:
        uint16(0) == 0x4d5a and             // "MZ" - PE file (captured binary dump)
        $uri_pattern and $http_version or
        ($uri_pattern and $host_header and ($user_agent_common or $user_agent_nc))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-36615 Mercusys AC12G /agileconfigreset Unauthenticated Memory Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/agileconfigreset"; http_uri; nocase; sid:20263661501; rev:1; metadata:attack_target Router, deployment Perimeter, cve CVE-2026-36615, signature_severity High, created_at 2026_07_01, updated_at 2026_07_01; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-36615;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5s
  [network where event.category == "network" and destination.port == 80 and
   network.protocol == "http" and http.request.method == "GET" and
   (url.path == "/agileconfigreset" or wildcard(url.path, "/agileconfigreset?*"))]
  [network where event.category == "network" and destination.port == 80 and
   network.protocol == "http" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined
| where uri_path="/agileconfigreset" OR uri_path LIKE "/agileconfigreset%"
| eval exploit_attempt=if(method="GET", "true", "false")
| stats count by src_ip, dest_ip, uri_path, method, useragent
| where count>0 AND exploit_attempt="true"
| table _time, src_ip, dest_ip, uri_path, method, useragent, count
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,router,">
    <rule id="100366" level="12">
        <decoded_as>web</decoded_as>
        <match>GET /agileconfigreset</match>
        <description>CVE-2026-36615: Mercusys AC12G undocumented /agileconfigreset endpoint accessed - possible memory disclosure</description>
        <group>access_control,web_application_attack,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <info type="cve">CVE-2026-36615</info>
        <info type="link">https://nvd.nist.gov/vuln/detail/CVE-2026-36615</info>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor (Mercusys) has not published a remediation advisory, firmware update, or workaround as of this report.

1. Immediate Mitigations

• Network Segmentation: Isolate the router's LAN interface from untrusted devices. Use a separate VLAN or subnet for guest Wi-Fi with a strict firewall rule blocking guest traffic from reaching the router's management interface (ports 80/8080).
• Disable WPS/Remote Management: Ensure remote (WAN-side) management is disabled. Verify the /agileconfigreset endpoint is not exposed to the WAN by testing from an external network.
• Restrict Management Access: Configure the router (if possible) to restrict web management access to specific administrative IPs/MACs only. Use the built-in access control list if the firmware supports it.
• Change All Credentials: Reset the router admin password and the Wi-Fi PSK immediately. Assume any credentials that may have been in memory were exposed if an untrusted device was ever on the network.
• Network Monitoring: Deploy the Sigma/Suricata/Splunk rules above on network taps or the router's upstream firewall to detect and alert on any access to /agileconfigreset.

2. Patch/Upgrade Steps

• Check for Firmware Updates: Visit the Mercusys official support page for the AC12G (EU) and check for any firmware released after AC12G(EU)_V1_200909. If a newer build exists, install it immediately.
• Contact Vendor: Open a support ticket with Mercusys referencing CVE-2026-36615. Request an advisory and a timeline for patched firmware.
• Monitor NVD and Vendor Channels: Recheck the NVD entry and the vendor's security advisories periodically for updates. Subscribe to threat feeds for CVE-2026-36615.

3. Long-Term Hardening

• Replace the Device: For business-critical environments, replace the Mercusys AC12G with a router from a vendor with a strong security track record and guaranteed firmware update cadence (e.g., enterprise-grade Ubiquiti, MikroTik, or Cisco). Consumer routers rarely receive long-term security support.
• Network Architecture: Place all network infrastructure behind a managed firewall with intrusion prevention. Do not expose consumer-grade routers directly to the LAN without a dedicated edge security device.
• Segmentation Policy: Implement strict network segmentation such that IoT devices and guest clients are on isolated VLANs with no route to management networks.
• Regular Firmware Audits: For any remaining Mercusys devices, establish a monthly check for new firmware and automate the deployment of updates.
• Disable Undocumented Endpoints: If possible, use a firewall rule (on an upstream device) to explicitly deny all traffic to the router's HTTP management port except from trusted admin IPs. This mitigates the endpoint even if the router itself cannot filter it.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36615
2. Mercusys Official Support: https://www.mercusys.com/en/support/downloads (Check for AC12G firmware updates)
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-36615 not listed as of this report)
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — adjacent-network variant)
5. FIRST CVSS Specification: https://www.first.org/cvss/ (For deriving a score of the adjacent-network unauthenticated memory disclosure)

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence are reported for CVE-2026-36615. The EPSS score of 0.00166 indicates an extremely low probability of active exploitation in the near term. However, the vulnerability is trivial to trigger (a single HTTP GET request) and will likely be weaponized in the coming months as scan data becomes available in public exploit repositories.