# CVE-2026-36610: Mercusys AC12G cleartext transmission of DDNS credentials

Source: https://junglewise.ai/threats/cve-2026-36610-mercusys-ac12g-cleartext-transmission-of-ddns-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-36610 · Severity: info · CVSS 5.9 · Published 2026-06-03

The Mercusys AC12G router fails to encrypt login credentials when connecting to Dynamic DNS (DDNS) services. Because the device sends this information over the open internet in a readable format, anyone positioned between the router and the service provider—such as an ISP or a malicious actor on the same network—can steal the account credentials. This could lead to unauthorized access to the user's DDNS account and potential security risks if the same password is used for other services.

Technologies: [Mercusys AC12G (EU) V1](https://junglewise.ai/threats/technologies/ac12g-eu-v1). Vendors: [Mercusys](https://junglewise.ai/threats/vendors/mercusys).

## Quick answers

**Is CVE-2026-36610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36610 being exploited in the wild.

**How severe is CVE-2026-36610?** Informational severity, with a CVSS score of 5.9, published 3 June 2026.

**Which products and versions are affected?** Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

**Is there a fix for CVE-2026-36610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36610 attacked?** It is attacked over the network or from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-36610?** Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DDNS client module in Mercusys AC12G (EU) V1 firmware (versions 200909 and 210128) lacks a TLS implementation, forcing all outbound DDNS updates to occur over plaintext HTTP. Credentials for providers like DynDNS and No-IP are sent using the 'Authorization: Basic' header, which utilizes Base64 encoding—a reversible format that provides no actual secrecy. An attacker with man-in-the-middle (MITM) capabilities, such as an ISP or an entity on an upstream network, can intercept these packets and decode the username and password. The vendor has reportedly designated the product as end-of-life, meaning no official security patches are expected.

## Affected products

- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

## Timeline

- 2026-06-03: disclosed
- 2026-06-03: advisory

## References

- [https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36610.md](https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36610.md)

## Related threats

- [Mercusys AC12G information disclosure in DNS resolver](https://junglewise.ai/threats/cve-2026-36618-mercusys-ac12g-information-disclosure-in-dns-resolver)
- [Mercusys AC12G Information Disclosure in HTTP Server](https://junglewise.ai/threats/cve-2026-36613-mercusys-ac12g-information-disclosure-in-http-server)
- [Mercusys AC12G weak WPS lockout and predictable PIN](https://junglewise.ai/threats/cve-2026-36612-mercusys-ac12g-weak-wps-lockout-and-predictable-pin)
- [Mercusys AC12G brute-force protection bypass in TDDP endpoint](https://junglewise.ai/threats/cve-2026-36607-mercusys-ac12g-brute-force-protection-bypass-in-tddp-endpoint)
- [Mercusys AC12G DNS rebinding via missing Host header validation](https://junglewise.ai/threats/cve-2026-36604-mercusys-ac12g-dns-rebinding-via-missing-host-header-validation)