# CVE-2026-36607: Mercusys AC12G brute-force protection bypass in TDDP endpoint

Source: https://junglewise.ai/threats/cve-2026-36607-mercusys-ac12g-brute-force-protection-bypass-in-tddp-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-36607 · Severity: info · CVSS 9.8 · Published 2026-06-03

The Mercusys AC12G router contains a security flaw that allows an attacker on the same network to guess the administrator password without being locked out. While the standard login page limits failed attempts, a secondary management feature lacks these protections, allowing for rapid, automated password guessing. If successful, an attacker gains full control over the router, enabling them to monitor internet traffic, change network settings, or redirect users to malicious websites.

Technologies: [Mercusys AC12G (EU) V1](https://junglewise.ai/threats/technologies/ac12g-eu-v1). Vendors: [Mercusys](https://junglewise.ai/threats/vendors/mercusys).

## Quick answers

**Is CVE-2026-36607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36607 being exploited in the wild.

**How severe is CVE-2026-36607?** Informational severity, with a CVSS score of 9.8, published 3 June 2026.

**Which products and versions are affected?** Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

**Is there a fix for CVE-2026-36607?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36607 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-36607?** Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the TDDP (TP-Link Device Debug Protocol) HTTP interface of the Mercusys AC12G (EU) V1 router. While the standard login endpoint (code=7) implements a lockout mechanism after five failed attempts, the password change endpoint (code=10) validates the administrator password without any rate limiting or lockout. An attacker on the adjacent network can perform unauthenticated brute-force attacks at speeds of 700-1500 attempts per second. The password encoding mechanism (orgAuthPwd) uses a static XOR salt and alphabet substitution documented in the router's client-side JavaScript, making it trivial for an attacker to automate the attack. Successful exploitation grants full administrative access. No fix is planned as the device is reportedly end-of-life.

## Affected products

- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

## Timeline

- 2026-06-03: disclosed
- 2026-06-03: advisory

## References

- [https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36607.md](https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36607.md)

## Related threats

- [Mercusys AC12G information disclosure in DNS resolver](https://junglewise.ai/threats/cve-2026-36618-mercusys-ac12g-information-disclosure-in-dns-resolver)
- [Mercusys AC12G Information Disclosure in HTTP Server](https://junglewise.ai/threats/cve-2026-36613-mercusys-ac12g-information-disclosure-in-http-server)
- [Mercusys AC12G weak WPS lockout and predictable PIN](https://junglewise.ai/threats/cve-2026-36612-mercusys-ac12g-weak-wps-lockout-and-predictable-pin)
- [Mercusys AC12G cleartext transmission of DDNS credentials](https://junglewise.ai/threats/cve-2026-36610-mercusys-ac12g-cleartext-transmission-of-ddns-credentials)
- [Mercusys AC12G DNS rebinding via missing Host header validation](https://junglewise.ai/threats/cve-2026-36604-mercusys-ac12g-dns-rebinding-via-missing-host-header-validation)