PT-2026-45998 · Mercusys · Ac12G

Tymbark7372 · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-36610

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909

Description The device transmits DDNS credentials over plaintext HTTP using only Base64 encoding. Because the firmware lacks a TLS (Transport Layer Security) implementation—a protocol designed to provide communications security over a computer network—an attacker can perform a man-in-the-middle interception to steal DDNS service credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-523

CWE-319

Related Identifiers

CVE-2026-36610

Affected Products

Ac12G

References · 3

• 🔥 https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36610.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36610 · Security Note
• https://t.me/cveNotify/165887 · Telegram Post