CVE-2026-78861

Executive Summary

CVE-2026-78861 affects the Mercusys AC12 V2 wireless router, which embeds a hardcoded 512-bit RSA private key within its firmware. A local attacker with access to the device can leverage this static cryptographic material to execute arbitrary code, fully compromising the device. Because the key is shared across all units of this hardware revision, any successful extraction undermines the device's trust model fleet-wide, exposing affected networks to complete takeover.

Technical Analysis

The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and concerns the storage and use of a static 512-bit RSA private key inside the Mercusys AC12 V2 firmware image. Per the NVD description, "An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key."

From a cryptographic standpoint, a 512-bit RSA key is severely under-strength by modern standards and is considered factorable with modest resources. The attack surface is local — the attacker requires some form of local access to the device (e.g., a session that can reach the firmware, debug interface, or the filesystem where the key resides). The presence of a shared, static private key means that once an attacker extracts or factors the key from any single device, the same key material is presumed valid across the entire product line for that hardware revision.

The precise firmware path, function name, or service that consumes this key is not disclosed in the available data, and no public advisory, CNA title detail, or CVE patch reference provides implementation specifics. Accordingly, this report describes the vulnerability at the class level — misuse of hardcoded asymmetric key material leading to code execution — rather than fabricating specific routes, binaries, or API parameters. No CVSS score, EPSS score, or CWE mapping was supplied by NVD at the time of writing; the subscores referenced in this report are inferred from the stated local attack vector and arbitrary code execution impact and should be treated as provisional.

Two characteristics elevate severity: (1) the arbitrary code execution outcome, meaning an attacker who can reach the key path can move from cryptographic compromise to direct control of the device; and (2) the hardcoded nature of the key, which is not unique per device, converting a single-device compromise into a systemic fleet-level exposure.

Exploitation Scenarios

No public Proof-of-Concept exists for CVE-2026-78861. The attack chain below is inferred from the vulnerability class (CWE-798, hardcoded private key enabling code execution) and the NVD description; it does not reference any verified function names or implementation details.

1. Reconnaissance / target identification. The attacker confirms the target is a Mercusys AC12 V2 (or identifies it via fingerprinting tools such as Shodan using the dorks in the metadata section). The attacker must obtain a local foothold, since the flaw is a local attack vector — this could mean a low-privilege session on the device management plane, access to a debug/UART interface, or the ability to read firmware/configuration data reachable locally.

2. Triggering the flaw class. Once the attacker has local access sufficient to reach the hardcoded key material, the static 512-bit RSA private key becomes readable or usable. Because the key is not unique per device, extraction from one unit is expected to yield the same key on other units of the same revision. If the key is used to authenticate or sign a trusted operation, possession of the key grants the attacker the device's own cryptographic identity.

3. Code execution (class-level). With the private key in hand, the attacker can craft or authorize a trusted operation that the device accepts — the exact mechanism (signed update, authenticated request, or similar) is not disclosed. The described outcome is arbitrary code execution on the device, moving the attacker from key possession to active control.

4. Post-exploitation impact. Successful code execution on a border router allows interception, redirection, or blocking of network traffic; persistent implant placement; credential harvesting from connected clients; and use of the device as a pivot into the internal network. Because the key is shared, containment of a single device does not remediate the fleet, and any environmental trust anchored to this key must be considered compromised.

Impact Assessment

CVE-2026-78861 enables an attacker who has obtained local access to the Mercusys AC12 V2 to convert under-strength, shared cryptographic material into arbitrary code execution on the device. The inferred CVSS v3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a base score of 7.8 (High): local vector, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact. No official CVSS score is currently assigned by NVD, and no EPSS score has been published by FIRST.org, so this score should be treated as an analyst estimate based strictly on the described local attack vector and code-execution impact.

Business impact: a compromised consumer or SMB router sits at the network edge, so device takeover directly threatens the confidentiality, integrity, and availability of all connected systems and traffic. The arbitrary code execution property means the attacker can persist, surveil, and pivot. Blast radius is amplified by the hardcoded nature of the key — any device sharing the same key material is effectively pre-compromised for mapping or authentication purposes. Affected systems are limited to the Mercusys AC12 V2 hardware revision; other Mercusys products are not indicated by the data. There is no evidence of CISA KEV listing, and no known active exploitation is documented at this time.

Detection Guidance

Sigma Rule

title: Hardcoded RSA Private Key Usage - Mercusys AC12 v2
id: 8f3a1c2e-9b4d-4e7a-a1c5-2d6f0b9e3a71
status: experimental
description: Detects access or exposure of static RSA private key material associated with CVE-2026-78861 on Mercusys AC12 v2 devices.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78861
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_access
  product: linux
  definition: Requires file access auditing on embedded device or host-based telemetry.
detection:
  selection_key:
    TargetFilename|endswith:
      - '.key'
      - '.pem'
      - 'rsa_private'
      - 'private.key'
  selection_unit:
    Image|contains:
      - 'merc'
      - 'ac12'
  condition: selection_key and selection_unit
fields:
  - TargetFilename
  - Image
  - User
falsepositives:
  - Legitimate embedded administrative tooling on the device
  - Vendor maintenance sessions
level: medium
tags:
  - attack.credential_access
  - attack.t1552.004

YARA Rule

rule CVE_2026_78861_Mercusys_AC12_Hardcoded_RSA
{
    meta:
        description = "Detects embedded static RSA private key material (CWE-798) linked to CVE-2026-78861 on Mercusys AC12 v2 firmware"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78861"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pem = "-----BEGIN RSA PRIVATE KEY-----"
        $pem_pkcs8 = "-----BEGIN PRIVATE KEY-----"
        $merc = "Mercusys" ascii wide nocase
        $ac12 = "AC12" ascii wide nocase

    condition:
        ($pem or $pem_pkcs8) and ($merc or $ac12)
}

Suricata IDS Rule

alert tcp any any -> any 80 (msg:"CVE-2026-78861 Potential Mercusys AC12 v2 Environment Identification (Local Attack Precondition)"; flow:to_server,established; content:"User-Agent|3a 20|"; http_header; content:"Mercusys"; http_header; nocase; classtype:attempted-recon; reference:cve,2026-78861; sid:202678861; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : ("wget", "curl", "tftp", "nc") and
  process.args : ("*Mercusys*", "*AC12*", "*ac12*")

Splunk SPL Query

index=network OR index=os_logs
| search ("Mercusys AC12" OR "merc_ac12" OR "AC12 V2")
| eval risk_score=case(match(_raw,"(?i)(private|\.key|rsa)"),"HIGH",true(),"MEDIUM")
| stats count values(host) as hosts by risk_score sourcetype
| where count > 0

Wazuh OSSEC Rule

<group name="cve_2026_78861,">
  <rule id="100861" level="10">
    <decoded_as>json</decoded_as>
    <field name="TargetFilename">\.(key|pem)$</field>
    <field name="Image">merc|ac12</field>
    <description>CVE-2026-78861: Possible access to hardcoded RSA private key on Mercusys AC12 v2</description>
    <mitre>
      <id>T1552.004</id>
    </mitre>
    <group>credential_access,pci_dss_10.2.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or firmware advisory has been identified in the available data, and no affected-version range has been published. The guidance below is risk-reduction rather than remediation.

1. Immediate mitigations

• Restrict local access to the Mercusys AC12 V2: disable remote administration, disable UPnP/WAN-side management where not required, and change default administrative credentials to strong unique values.
• Physically and logically isolate the device; disable unused services (Telnet, SSH, debug interfaces) where the platform allows.
• Network-segment the router/AP so that compromise does not provide direct access to sensitive internal assets.

2. Patch / upgrade steps

• Monitor the Mercusys support and security channels and NVD (CVE-2026-78861) for an official firmware release; no patch currently exists per available data.
• When a firmware update is released, validate its signature/hash against the vendor source, back up configuration, and apply the update across all AC12 V2 units — noting the shared-key issue means the whole fleet must be treated as affected, not a subset.
• Treat the key material itself as compromised: any internal cryptographic trust that references this device key should be rotated or revoked once a fix is available.

3. Long-term hardening

• Where feasible, replace AC12 V2 hardware with devices that implement per-device unique keys and secure boot.
• Apply network access control and continuous monitoring on edge devices; assume that any firmware-embedded static credential is a permanent risk.
• Adopt firmware integrity verification and a regular patch cadence for all edge networking equipment, and inventory devices by exact hardware revision to identify fleet-wide exposures.

References

• NVD — CVE-2026-78861: https://nvd.nist.gov/vuln/detail/CVE-2026-78861
• CWE-798 — Use of Hard-coded Credentials: https://cwe.mitre.org/data/definitions/798.html
• MITRE ATT&CK T1552.004 — Unsecured Credentials: Private Keys: https://attack.mitre.org/techniques/T1552/004/
• Mercusys official support/downloads portal (monitor for firmware advisories): https://www.mercusys.com/support
• CISA Known Exploited Vulnerabilities (KEV) catalog (currently no entry for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or in-the-wild exploitation evidence was available at the time of writing. No CISA KEV listing exists. No threat actor campaign tied to CVE-2026-78861 has been identified in the provided data.