CVE-2026-78860

Executive Summary

CVE-2026-78860 is a cleartext storage of sensitive information vulnerability in the Mercusys AC12 V2 wireless router that permits a local attacker to execute arbitrary code. The flaw stems from the device storing information in plaintext, which a locally positioned attacker can leverage to reach code execution on the router. No CVSS score has been assigned by NVD, no CWE mapping has been published, and no public proof-of-concept, exploit code, or Nuclei template exists; the device remains unpatched with zero patch confidence across all tracked sources.

Technical Analysis

The vulnerability class is cleartext storage of sensitive information (CWE-312). Per the NVD description, the Mercusys AC12 V2 stores information in plaintext, and this storage weakness enables a local attacker to execute arbitrary code. The precise mechanism by which plaintext storage translates into code execution is not disclosed in the available description, and no vendor technical advisory, firmware analysis, or researcher disclosure has been published. As a result, the following analysis is constrained strictly to what the vulnerability class and the description support.

In embedded router architectures, cleartext storage of sensitive information typically manifests as one or more of the following conditions: credentials, authentication tokens, configuration parameters, or cryptographic material persisted in readable form. Because the NVD entry explicitly ties the outcome to arbitrary code execution, the stored plaintext material most plausibly includes a secret that is consumed by some component of the device's management or execution path — the description does not specify which. The attack surface is therefore local: an attacker requires a position on the device or on a local network segment adjacent to it. The CVSS vector used in this report (AV:L) reflects the explicitly local nature of the attack stated in the NVD description.

No function names, file paths, binary names, configuration keys, endpoint routes, or daemon names are provided in the source data. This report deliberately does not fabricate any such identifiers. Any implementation-level claim beyond what is documented here would be speculation and is excluded by policy.

The absence of a CWE mapping from NVD is notable; CWE-312 is applied here based on the literal description ("storage of information in plaintext") and should be treated as an analyst-assigned classification rather than a vendor or NVD-confirmed mapping. Organizations tracking this CVE should expect the classification to be refined if a vendor advisory or CNA update is published.

Because the device is unpatched and no fixed firmware version is identified, every deployed AC12 V2 unit must be treated as potentially affected until a vendor statement indicates otherwise. There is no indication of a compensating control, hardened build, or vendor-provided workaround in the source data.

Exploitation Scenarios

No public proof-of-concept is available, and the attack chain below is inferred from the vulnerability class (cleartext storage enabling code execution) rather than from a disclosed exploit. Where the NVD description does not specify implementation details, those details are intentionally omitted rather than invented.

1. Reconnaissance and target identification. The attacker must first obtain a local position relative to an AC12 V2 device. This could be a host on the same LAN as the router, an adjacent wireless client, or an actor with any form of local access to the device or its environment. Reconnaissance consists of identifying a Mercusys AC12 V2 in scope, for example by observing the device on a local segment. No remote pre-authentication vector is described.

2. Triggering the flaw class. The attacker obtains the information that the device stores in cleartext. Because the description does not name the storage location, the analyst cannot state whether this involves reading a configuration store, a credential cache, or another plaintext artifact; what is known is that the material is not protected and is therefore accessible to a locally positioned attacker. The "trigger" is fundamentally a disclosure step: the attacker reads material the device failed to protect.

3. Execution method (class level). The disclosed material is of a type that can be leveraged to cause arbitrary code execution on the device. At the class level, this means the attacker uses disclosed secrets or configuration values to reach a privileged execution path — for example by authenticating to a management interface or by supplying input to a component that trusts the plaintext value. The specific interface, parameter, or payload is not documented and is not asserted here. No exploitation of memory corruption, injection, or deserialization is claimed, because the description does not state that any such primitive exists.

4. Post-exploitation impact. Successful exploitation yields arbitrary code execution on the router. In router context, this typically grants the attacker control of routing, DNS, firewall behavior, and traffic handling, and can serve as a persistence point for further lateral movement. Impact is scored High for confidentiality, integrity, and availability in the absence of an NVD-published vector; this is an analyst estimate and should be treated as provisional.

Because there is no public exploit, no observed in-the-wild exploitation, and no CISA KEV listing, the immediate likelihood of opportunistic mass exploitation is low. The primary risk is to environments where local access is attainable — shared physical spaces, insider scenarios, or compromised hosts on the same segment.

Impact Assessment

The impact centers on a device that sits at a trust boundary: a wireless router that forwards, routes, and often resolves DNS for connected clients. Arbitrary code execution on that device gives an attacker a position to observe, modify, or redirect traffic, and to persist on the network edge.

Business impact:

• Confidentiality (High, analyst estimate): plaintext storage means sensitive material is exposed to any local reader; code execution further enables interception of traffic passing through the device.
• Integrity (High, analyst estimate): an attacker with code execution can alter routing, DNS responses, or device configuration.
• Availability (High, analyst estimate): control of the device permits disruption of network service for all clients behind it.

Blast radius is bounded by the local requirement. A single compromised or malicious host on the same segment can potentially affect every client served by the AC12 V2. In multi-tenant deployments (SMB offices, retail, hospitality, shared residential), this materially broadens exposure. No CVSS score has been published by NVD; the vector used in this report is an analyst construction and is labeled as such. There is no EPSS score, and none is fabricated here.

Detection Guidance

Detection is constrained by the absence of disclosed indicators. The rules below target the general behavior class: local access to a router and subsequent use of the device (management access, configuration changes, anomalous execution on the embedded system) rather than a specific named exploit artifact.

Sigma Rule

title: Suspicious Local Access to Mercusys AC12 V2 Management Interface
id: 7f3c1a92-4d6e-4b21-9c88-0a1b2c3d4e5f
status: experimental
description: Detects repeated or anomalous local administrative access to a Mercusys AC12 V2 router, consistent with post-disclosure use of cleartext-stored information (CVE-2026-78860).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78860
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationIp|cidr:
      - '192.168.0.0/16'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
  selection_port:
    DestinationPort:
      - 80
      - 443
      - 8080
  selection_tool:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\powershell.exe'
  condition: selection_dest and selection_port and selection_tool
fields:
  - Image
  - DestinationIp
  - DestinationPort
falsepositives:
  - Legitimate administrative tooling and network inventory scans
level: low

YARA Rule

rule CVE_2026_78860_Mercusys_AC12_Plaintext_Storage_Indicator
{
    meta:
        description = "Heuristic indicator for cleartext-stored credential/secret material associated with Mercusys AC12 V2 research (CVE-2026-78860). Not a signature for a specific exploit."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78860"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $m1 = "MERCUSYS" ascii wide nocase
        $m2 = "AC12" ascii wide nocase
        $p1 = "password" ascii wide nocase
        $p2 = "passwd" ascii wide nocase
        $p3 = "admin" ascii wide nocase
        $p4 = "secret" ascii wide nocase
        $p5 = "token" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x464C457F or true
        and $m1
        and 1 of ($p*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-78860 Potential Mercusys AC12 V2 Management Access - Possible Cleartext Credential Use"; flow:to_server,established; http.method; content:"GET"; http.header; content:"Authorization"; nocase; http.host; content:"192.168."; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78860; classtype:attempted-admin; sid:9007886; rev:1;)

Elastic Detection

network where destination.port in (80, 443, 8080) and
  destination.ip like "192.168.*" and
  process.name in ("curl", "wget", "powershell.exe", "python3") and
  event.category == "network" and
  network.direction == "outbound"

Splunk SPL Query

index=network OR index=firewall
| where (dest_port=80 OR dest_port=443 OR dest_port=8080)
| where cidrmatch("192.168.0.0/16", dest_ip) OR cidrmatch("10.0.0.0/8", dest_ip)
| where match(process_name, "(?i)(curl|wget|powershell|python)")
| stats count values(dest_ip) as targets by src_ip, process_name
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="cve_2026_78860,router_abuse,">
  <rule id="100860" level="7">
    <if_sid>31100</if_sid>
    <match>MERCUSYS|AC12</match>
    <description>CVE-2026-78860: Possible access to Mercusys AC12 V2 local management interface</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
  <rule id="100861" level="8">
    <if_sid>100860</if_sid>
    <match>admin|password|token|secret</match>
    <description>CVE-2026-78860: Possible use of cleartext-stored credential material against Mercusys AC12 V2</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, fixed version, or workaround is recorded in any tracked source.

1. Immediate mitigations

   • Isolate the device: place AC12 V2 units on segregated VLANs and restrict which hosts can reach the router's management interface. The attack is local, so network segmentation directly reduces the exposed population of potential attackers.
   • Restrict management access to a single trusted administrative host and disable management from wireless clients wherever the firmware permits.
   • Assume any secrets stored on the device are compromised; rotate administrative and network credentials that are shared with, or derived from, AC12 V2 configuration.
   • Monitor for anomalous traffic from hosts on the same segment toward the router's management interfaces (see Detection Guidance).

2. Patch/upgrade steps

   • No patched firmware version is identified. Until Mercusys publishes a fixed release for AC12 V2, treat all AC12 V2 units as affected. Check the Mercusys support/product page for AC12 V2 firmware and apply the latest available release, then verify whether it addresses this CVE.
   • If no fix becomes available and the device cannot be isolated to an acceptable residual risk level, plan for replacement with a product that has an active security-advisory process.

3. Long-term hardening

   • Inventory all edge devices and track vendor advisories; unpatched consumer/SOHO routers on the perimeter are a recurring weak point.
   • Enforce credential hygiene: never reuse router admin credentials elsewhere, and rotate on any suspicion of local compromise.
   • Adopt architectures where management planes are not reachable from general client segments, and prefer devices with a demonstrated patch cadence.
   • Enable centralized logging of router-adjacent authentication and configuration activity.

References

• NVD — CVE-2026-78860: https://nvd.nist.gov/vuln/detail/CVE-2026-78860
• MITRE ATT&CK — T1203 Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• CWE-312 Cleartext Storage of Sensitive Information: https://cwe.mitre.org/data/definitions/312.html
• CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Mercusys product/support portal for AC12 V2 firmware status (no advisory confirmed at time of writing): https://www.mercusys.com/

No threat actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept have been identified for CVE-2026-78860.