PT-2026-46001 · Undefined · Undefined

Tymbark7372 · CVE-2026-36613 · Published 2026-06-03 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909

Description The device returns 128 bytes of uninitialized internal buffer contents when it receives HTTP POST requests sent to undefined paths. This behavior allows unauthenticated attackers on the adjacent network to gain information about the server state.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-36613

Affected Products

Undefined

References · 2

• 🔥 https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36613.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36613 · Security Note