Tymbark7372

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** The UPnP GetStatusInfo action discloses kernel memory layout. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, which reveals the kernel memory layout and facilitates further exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** The device exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including `AddPortMapping` and `GetExternalIPAddress`. Universal Plug and Play (UPnP), a protocol that allows devices to discover each other and establish communication services on a network, is enabled by default. This allows any unauthenticated device on the local area network (LAN) to create arbitrary port forwarding rules and access WAN traffic statistics. **Recommendations** Disable UPnP through the admin interface for version AC12G(EU) V1 200909.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** The device fails to validate the HTTP Host header, which allows for DNS rebinding attacks. This occurs when an attacker rebinds a domain to the internal IP address of the router, leveraging a CORS wildcard vulnerability where the `Access-Control-Allow-Origin` header is set to `*`. This combination enables attacks originating from the internet to bypass security restrictions. CORS (Cross-Origin Resource Sharing) is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** An issue exists where a small number of crafted incomplete HTTP requests can trigger a HTTP denial of service. This results in a persistent crash of the system, necessitating a physical power cycle to restore functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** Configuration backups are encrypted using a hardcoded DES key with single DES in ECB (Electronic Codebook) mode, which is a basic encryption mode that does not use an initialization vector. An attacker with access to a backup file can decrypt it to recover sensitive stored credentials, such as the administrator password, WiFi PSK, and DDNS credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** An unauthenticated attacker on the adjacent network can perform brute-force attacks because the TDDP password change endpoint 'code=10' lacks the rate limiting implemented on the login endpoint 'code=7'. This allows for unlimited password attempts without triggering an account lockout. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 firmware AC12G(EU) V1 200909 **Description** The UPnP AddPortMapping feature allows external ports to be forwarded to the router's own administration interface. This occurs because the system accepts the router's own IP (192.168.1.1) or localhost (127.0.0.1) as the `InternalClient` variable. An unauthenticated attacker on the local area network can expose the administration panel to the internet using a single SOAP request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 firmware AC12G(EU) V1 200909 **Description** The device uses a static authentication nonce that remains unchanged between requests originating from the same source IP. This issue, combined with a predictable XOR-based password encoding implemented in the `securityEncode()` function, enables an attacker to reverse captured authentication tokens to recover the plaintext password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** The device transmits DDNS credentials over plaintext HTTP using only Base64 encoding. Because the firmware lacks a TLS (Transport Layer Security) implementation—a protocol designed to provide communications security over a computer network—an attacker can perform a man-in-the-middle interception to steal DDNS service credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** An issue exists where the device returns 128 bytes of uninitialized buffer when receiving POST requests that lack a `SOAPAction` header on the UPnP port 1900. This allows unauthenticated adjacent network attackers to expose internal memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** Wi-Fi Protected Setup (WPS) 2.0 is enabled by default and implements a weak lockout policy, which only triggers a 60-second lockout after 10 failed attempts. **Recommendations** For version AC12G(EU) V1 200909, disable the WPS 2.0 feature to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** The device returns 128 bytes of uninitialized internal buffer contents when it receives HTTP POST requests sent to undefined paths. This behavior allows unauthenticated attackers on the adjacent network to gain information about the server state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** An undocumented '/agileconfigreset' endpoint exposes internal buffer contents to unauthenticated attackers located on the adjacent network. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** Production firmware contains hardcoded WiFi driver credentials. These include a RADIUS shared secret, a WPS test key, and a default PSK (Pre-Shared Key, a shared secret used in WPA/WPA2 for authentication) embedded within the binary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909 **Description** The device responds to `version.bind` CHAOS TXT queries, which results in the disclosure of the DNS resolver software version (`unbound 1.22.0`). This information can be used to facilitate targeted attacks by identifying known weaknesses in the specific software version. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.