Executive brief
The Mercusys AC12G router, a device used to provide home and small office internet connectivity, contains a security flaw in how it handles login credentials. Because the router uses predictable security codes and fails to change them between login attempts, an attacker who monitors network traffic can easily intercept and decode the administrator's password. This could allow an unauthorized person to take full control of the router, change network settings, or monitor user activity.
Technical details
The Mercusys AC12G (EU) V1 router's authentication mechanism (TDDP protocol) utilizes a static 32-character nonce that is generated only once per boot per source IP. The password encoding process, handled by the 'securityEncode' function in /lib/Quary.js, employs a simple XOR-based scheme with a hardcoded salt ('RDpbLfCPsJZ7fiv'). Because the nonce is static and the encoding is deterministic and reversible, a network-based attacker can capture an authentication token and reverse it to recover the plaintext password. Additionally, the lack of token rotation or expiration allows for indefinite session replay and offline dictionary attacks. The product is reportedly end-of-life, and no official patch is expected.
Affected products
- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128
Timeline
- 2026-06-03: advisory: NVD and researcher advisory published