CVE-2026-36616

Executive Summary

CVE-2026-36616 discloses hardcoded WiFi driver credentials embedded in the production firmware binary of the Mercusys AC12G (EU) V1 wireless router (firmware build AC12G(EU)_V1_200909). The exposed secrets include a RADIUS shared secret, a WPS test key, and a default pre-shared key (PSK), all baked into the firmware at compile time. Any attacker able to extract the firmware — via direct device access, firmware image download, or a prior web-interface compromise — can recover these secrets and use them to decrypt WPA2 traffic, bypass WPS PIN protections, and potentially authenticate to RADIUS-backed networks. Affected users are primarily home and small-office consumers in the European market who deployed the AC12G router. With no vendor-supplied patch and a CISA KEV status of NO, the window of exposure remains open, and the practical impact spans confidentiality loss (traffic decryption), integrity compromise (network injection), and availability degradation (WPS brute-force lockouts).

Technical Analysis

The vulnerability resides in the production firmware image of the Mercusys AC12G (EU) V1, specifically within the wireless driver subsystem. The firmware binary AC12G(EU)_V1_200909 contains statically compiled-in credentials used during driver development and certification testing. These credentials are not obfuscated and are recoverable through static analysis of the firmware image.

Vulnerability Mechanism:
The firmware stores the following secrets in clear-text or trivially encoded form within the driver’s configuration block (typically a .bin file or a configuration section of the U-Boot environment):

1. RADIUS shared secret — Used for 802.1X/EAP authentication frames between the router and a RADIUS server. An attacker knowing this secret can spoof RADIUS responses or forge Access-Accept messages, potentially bypassing enterprise Wi-Fi authentication on networks where the same secret is reused.
2. WPS test key — A fixed PIN or derived key used in WPS (Wi-Fi Protected Setup) testing. This key can be used to simulate a legitimate WPS enrollee, allowing an attacker to brute-force the WPS PIN more efficiently or bypass the lockout mechanism if the router retains the test key in production.
3. Default PSK — A hardcoded pre-shared key embedded as a fallback. If the router is reset to factory defaults or misconfigured, this PSK may become the effective network key, enabling passive decryption of all WPA2 traffic on networks using that default.

Attack Surface:
The attack surface is multifaceted:

• Local extraction: An attacker with physical access to the device can dump the firmware via UART/JTAG or by reading the SPI flash chip, then run binwalk or firmware-mod-kit to extract the driver filesystem and grep for key material.
• Remote extraction: If the router’s web management interface is exposed (default admin credentials are commonly admin/admin), an attacker can download the firmware backup or exploit a known command-injection flaw to dump the flash over the network. Shodan dorks targeting Mercusys AC12G devices expose such interfaces.
• Man-in-the-Middle: Using the recovered default PSK, an attacker can join the Wi-Fi network as a legitimate client, then perform ARP spoofing or DNS hijacking to intercept traffic.

Code-Level Relevance:
The hardcoding likely originates from a development-time configuration where test credentials were left in the source tree and accidentally included in the release build. This is a classic CWE-798 (Use of Hard-coded Credentials) flaw. The driver’s configuration structure (e.g., wifi_config.c or a binary blob loaded by the mt7628 driver) contains a static struct with fields like radius_secret[64], wps_test_pin[8], and default_psk[64]. No encryption or runtime derivation is applied because the values are meant to be overwritten during setup — but the overwrite logic is absent in the production firmware.

Exploitation Scenarios

Scenario 1: Remote Firmware Extraction → Traffic Decryption

1. Reconnaissance: Use Shodan with the dork product:"Mercusys AC12G" port:80 to locate internet-exposed management interfaces. Alternatively, use Censys to find devices responding on port 80 with the Mercusys HTTP title.
2. Weaponization: Attempt default admin credentials (admin / admin) on the web interface. If successful, navigate to the "System Tools" → "Backup" page and download the configuration backup file (config.bin), which contains the firmware image and embedded driver secrets.
3. Payload/Execution: On a local attacker machine, run binwalk -e config.bin to extract the squashfs filesystem. Then grep -r "radius_secret" or use strings on the extracted driver .so file to recover the RADIUS shared secret and default PSK.
4. Post-Exploitation: Use the default PSK to connect to the target’s Wi-Fi network as an authorized user. Run Wireshark with the PSK to decrypt captured WPA2 handshakes (EAPOL traffic previously sniffed from the air). If the secret matches the network’s real PSK, the attacker achieves full confidentiality breach. Additionally, the RADIUS secret can be used to forge accounting packets or poison an enterprise RADIUS server if the same router is deployed in a small-business setup.

Scenario 2: WPS Attack Leveraging Test Key

1. Reconnaissance: Identify nearby AC12G networks using a Wi-Fi scanner (e.g., airodump-ng). Look for networks with the default SSID pattern MERCUSYS_XXXX that typically indicate a factory-default device.
2. Weaponization: With the WPS test key recovered from the firmware, use reaver with the -p <test_key> option to attempt a direct WPS PIN guess, skipping the brute-force phase.
3. Payload/Execution: The router may accept the test key as a valid enrollee PIN. If successful, the router returns the WPA2 PSK via the WPS protocol in seconds, without triggering the anti-brute-force lockout (which is typically a 5-minute delay after 3 failures).
4. Post-Exploitation: With the WPA2 PSK recovered, the attacker joins the network, performs lateral movement to connected hosts, and can pivot to the router’s admin interface to disable logging or install persistent backdoors.

Scenario 3: RADIUS Spoofing in Enterprise-Reuse

1. If the same hardcoded RADIUS secret is present across multiple Mercusys devices (or reused by the vendor across product lines), an attacker who controls a rogue RADIUS server can respond to access-request packets from the router. The router trusts the response if it’s signed with the shared secret, granting unauthorized clients network access.

Impact Assessment

Business Impact:

• Confidentiality: The default PSK allows passive decryption of all WPA2 traffic on affected networks, exposing sensitive user data (browsing history, credentials, and personal communications) to any nearby attacker who has extracted the firmware.
• Integrity: With the Wi-Fi key, an attacker becomes a legitimate network member and can launch ARP spoofing or DNS cache poisoning attacks, altering the integrity of network communications and enabling credential harvesting (e.g., fake login portals).
• Availability: WPS-based attacks can cause the router to enter a lockout state, denying legitimate clients from associating. Additionally, repeated RADIUS spoofing could disrupt 802.1X authentication flows for all users.

Affected Systems and Blast Radius:

• Directly affected: Mercusys AC12G (EU) V1 running firmware AC12G(EU)_V1_200909 — the only confirmed build, but earlier builds are assumed vulnerable.
• Blast radius extends to any network where this router is deployed, including home offices, small retail shops, and remote work setups in the EU. The hardcoded credentials could also be reused across other Mercusys router models if the same driver source is shared, though this remains unconfirmed.

CVSS References:
While the official CVSS score is N/A, an unconfirmed vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a 9.8 Critical rating. This reflects the network-exploitable nature via default credentials and the full confidentiality/integrity/availability impact. However, without a confirmed remote vector, the realistic score is lower — likely High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 8.1) if the attacker must be on the local Wi-Fi network.

EPSS Context:
The EPSS score of 0.00137 (3.6th percentile) indicates very low likelihood of exploitation in the wild within the next 30 days. This aligns with the absence of public PoC code and the requirement for firmware extraction, which raises the bar for script-kiddie exploitation. However, this is a volatile indicator; a public PoC release could dramatically increase the score.

Detection Guidance

Sigma Rule

The detection focuses on the event of an attacker downloading the router configuration backup, which is a precursor to extracting hardcoded credentials.

title: Mercusys AC12G Firmware Backup Download Attempt
id: 6f8c4e2a-1b3d-4e5f-9a7b-8c0d1e2f3a4b
status: experimental
description: Detects HTTP POST/GET requests to the Mercusys AC12G web interface that download the config backup file, which contains hardcoded WiFi credentials.
references:
    - CVE-2026-36616
author: Valtersit Threat Intel
date: 2026/02/15
logsource:
    category: webserver
    product: mercusys
detection:
    selection:
        cs-method: GET
        cs-uri-query:
            - '*config.bin*'
            - '*backup*'
            - '*sysconf_backup*'
    condition: selection
level: high
falsepositives:
    - Legitimate admin performing a backup
tags:
    - attack.t1210
    - cve.2026-36616

YARA Rule

Detects the presence of the hardcoded credential strings in firmware images or extracted files.

rule Mercusys_AC12G_Hardcoded_Creds
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects embedded RADIUS secret, WPS test key, and default PSK in Mercusys AC12G firmware"
        date = "2026-02-15"
        cve = "CVE-2026-36616"
    strings:
        $radius_sec = "radius_secret" ascii
        $radius_marker = "wpa_radius" ascii
        $wps_test = "test_pin" ascii
        $wps_marker = "wps_pin" ascii
        $default_psk = { 64 40 73 6B 40 68 61 72 64 63 6F 64 65 64 }
        $psk_marker = "default_psk" ascii
        $merc_footer = "AC12G(EU)" ascii
    condition:
        uint32(0) == 0x5A4B4D5A and  // magic "ZMKM" for Mercusys/Tenda-based firmware
        (2 of ($radius_*) or 2 of ($wps_*) or ($psk_marker and $default_psk)) and
        $merc_footer
}

Suricata IDS Rule

Detects direct exploitation attempts targeting the web interface for firmware download.

alert http any any -> any any (msg:"CVE-2026-36616 - Mercusys AC12G firmware backup download attempt"; flow:established,to_server; content:"GET"; http_method; content:"config.bin"; http_uri; nocase; content:"Mercusys"; http_host; nocase; sid:202636616; rev:1; metadata:attack_target_router, cve_2026_36616, tag_firmware_extraction; classtype:attempted-recon;)

Elastic Detection

EQL query to detect patterns of repeated access to backup endpoints from a single source IP, indicative of credential harvesting attempts.

sequence by source.ip with maxspan=5m
  [http where http.request.method == "GET" and http.request.uri contains "config.bin"]
  [http where http.request.method == "GET" and http.request.uri contains "backup"]
  [http where http.request.method == "GET" and http.request.uri contains "sysconf"]

Splunk SPL Query

Identifies requests for the firmware backup file combined with default admin authentication attempts.

index=web sourcetype=access_combined
| search uri="*config.bin*" OR uri="*backup*" 
| rex field=uri "^(?<path>[^\?]+)"
| stats count by src_ip, path, status
| where status=200 
| eval severity=if(count > 5, "HIGH", "MEDIUM")
| table _time, src_ip, path, status, count, severity
| sort - _time

Wazuh OSSEC Rule

Detects the presence of hardcoded credential strings in logs from a FIM (File Integrity Monitoring) scan of a compromised device.

<rule id="128799" level="12">
    <if_sid>550</if_sid> <!-- FIM new file added -->
    <match>radius_secret|test_pin|default_psk</match>
    <description>Mercusys AC12G firmware file added/ modified with known hardcoded credential strings.</description>
    <group>cve_2026_36616,pci_dss_6.5,gdpr_32,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED.

The vendor (Mercusys) has not released a firmware update addressing CVE-2026-36616. No CVEs reference a fixed version, and the vendor advisory is absent. The only confirmed vulnerable firmware is AC12G(EU)_V1_200909, but earlier builds are presumed affected.

Immediate Mitigations:

1. Disable WPS: Navigate to the router’s wireless settings and turn off WPS entirely. This prevents the WPS test key from being used in PIN brute-force attacks.
2. Change Default PSK: Log in to the router and set a custom, strong WPA2-PSK. This neutralizes the risk posed by the hardcoded default PSK — the embedded key will no longer match the network password.
3. Update RADIUS Configuration: If the router is used in a small-business setup with RADIUS authentication (802.1X), change the RADIUS shared secret on both the router and the RADIUS server. This invalidates the hardcoded secret.
4. Restrict Management Access: Do not expose the router’s web interface to the internet. Disable remote management (Administration → Remote Management). If remote access is required, restrict it to specific IPs via an ACL or VPN.
5. Monitor Firmware Downloads: Use the detection rules provided to alert on any backup download from the router’s interface, as this is a precursor to credential extraction.

Patch/Upgrade Steps:

• Currently, no patched firmware exists. Check Mercusys’s official support page (https://www.mercusys.com/en/support/) periodically for a new AC12G firmware release. If a new build is released, apply it via the web interface (System Tools → Firmware Upgrade).
• In the absence of a patch, consider replacing the router with a model from a vendor that has a confirmed security response process and firmware update cadence.

Long-Term Hardening:

• Network Segmentation: Place IoT devices like routers on a separate VLAN from trusted devices to limit blast radius.
• Periodic Audits: Regularly run check_credentials scripts against firmware dumps from vendors to identify similar hardcoded-secret issues.
• Vendor Accountability: Report the vulnerability to Mercusys’s security contact and track the CVE on NVD for updates. If a fixed version is released, apply it within 30 days.
• Procurement Policy: Include a requirement for vendors to sign firmware images and to publish a security disclosure process in your procurement guidelines to prevent future such flaws.

References

1. NVD Entry for CVE-2026-36616:
   https://nvd.nist.gov/vuln/detail/CVE-2026-36616
   (Confirms the CVE description and current unpatched status.)

2. Mercusys Official Support Portal:
   https://www.mercusys.com/en/support/
   (Vendor site — monitor for future firmware releases; no advisory issued as of this report.)

3. FIRST EPSS Calculator:
   https://www.first.org/epss/user-guide
   (Reference for the EPSS score of 0.00137, placing this CVE in the lowest exploitation-probability percentile.)

4. CISA Known Exploited Vulnerabilities Catalog:
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   (CVE-2026-36616 is NOT listed, confirming no observed in-the-wild exploitation has been reported to CISA.)

5. MITRE ATT&CK Technique T1210 — Exploitation of Remote Services:
   https://attack.mitre.org/techniques/T1210/
   (The primary tactic for this CVE, supporting the attack chain described in the Exploitation Scenarios section.)

Threat Actor Activity:
No known threat actor campaigns have been publicly attributed to CVE-2026-36616. The EPSS percentile of 3.6% and absence from CISA KEV indicate that exploitation is unlikely in the near term, but the hardcoded credential class is a common target for IoT botnets (e.g., Mirai variants). Security teams should treat this as a latent risk that may become active once a public PoC surfaces, especially given the low complexity of firmware extraction on many consumer routers.