PT-2026-46000 · Undefined · Undefined

Tymbark7372 · CVE-2026-36612 · Published 2026-06-03 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909

Description Wi-Fi Protected Setup (WPS) 2.0 is enabled by default and implements a weak lockout policy, which only triggers a 60-second lockout after 10 failed attempts.

Recommendations For version AC12G(EU) V1 200909, disable the WPS 2.0 feature to prevent unauthorized access.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-1188

CWE-307

Related Identifiers

CVE-2026-36612

Affected Products

Undefined

References · 2

• 🔥 https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36612.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36612 · Security Note