CVE-2026-36616

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware binary.

Score

CVSS 3.1 5.9 Medium

Status

Deferred - cve@mitre.org

Published

2026-06-03

Last modified

2026-06-04

Weaknesses

CWE-1188, CWE-798

References

• https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36616.md