Is CVE-2026-36611 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36611 being exploited in the wild.

How severe is CVE-2026-36611?

Informational severity, with a CVSS score of 5.3, published 3 June 2026.

Which products and versions are affected?

Mercusys AC12G AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

Is there a fix for CVE-2026-36611?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36611 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-36611?

Check whether you run Mercusys AC12G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36611: Mercusys AC12G uninitialized buffer disclosure in UPnP

CVE-2026-36611 · Severity: info · CVSS 5.3 · Published 2026-06-03

The Mercusys AC12G is a wireless router used for home and small office networking. A security flaw in its UPnP service allows an attacker on the same local network to view small fragments of the device's internal memory. This could potentially expose sensitive technical information or data from previous network requests, though the device is now end-of-life and unlikely to receive a fix.

Technologies: Mercusys AC12G. Vendors: Mercusys.

Quick answers

Is CVE-2026-36611 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36611 being exploited in the wild.
How severe is CVE-2026-36611?: Informational severity, with a CVSS score of 5.3, published 3 June 2026.
Which products and versions are affected?: Mercusys AC12G AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.
Is there a fix for CVE-2026-36611?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36611 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-36611?: Check whether you run Mercusys AC12G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure (CWE-200) and out-of-bounds read (CWE-125) within the UPnP HTTP server on port 1900. When the server receives a POST request to any endpoint (such as /ipc, /ifc, or /l3f) without a SOAPAction header, it fails to return a standard HTTP error and instead returns 128 bytes of an uninitialized internal buffer. This buffer can contain null-separated header key-value pairs from the current request, fragments of HTTP response templates, or data from previous requests due to a shared response buffer pool. The attack requires no authentication but must be performed from an adjacent network (LAN). The product is reportedly end-of-life with no planned patch.

Affected products

Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

Timeline

2026-06-03: disclosed
2026-06-03: advisory

References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36611.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.