# CVE-2026-36611: Mercusys AC12G uninitialized buffer disclosure in UPnP

Source: https://junglewise.ai/threats/cve-2026-36611-mercusys-ac12g-uninitialized-buffer-disclosure-in-upnp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-36611 · Severity: info · CVSS 5.3 · Published 2026-06-03

The Mercusys AC12G is a wireless router used for home and small office networking. A security flaw in its UPnP service allows an attacker on the same local network to view small fragments of the device's internal memory. This could potentially expose sensitive technical information or data from previous network requests, though the device is now end-of-life and unlikely to receive a fix.

Technologies: [Mercusys AC12G](https://junglewise.ai/threats/technologies/ac12g). Vendors: [Mercusys](https://junglewise.ai/threats/vendors/mercusys).

## Quick answers

**Is CVE-2026-36611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36611 being exploited in the wild.

**How severe is CVE-2026-36611?** Informational severity, with a CVSS score of 5.3, published 3 June 2026.

**Which products and versions are affected?** Mercusys AC12G AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

**Is there a fix for CVE-2026-36611?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36611 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-36611?** Check whether you run Mercusys AC12G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure (CWE-200) and out-of-bounds read (CWE-125) within the UPnP HTTP server on port 1900. When the server receives a POST request to any endpoint (such as /ipc, /ifc, or /l3f) without a SOAPAction header, it fails to return a standard HTTP error and instead returns 128 bytes of an uninitialized internal buffer. This buffer can contain null-separated header key-value pairs from the current request, fragments of HTTP response templates, or data from previous requests due to a shared response buffer pool. The attack requires no authentication but must be performed from an adjacent network (LAN). The product is reportedly end-of-life with no planned patch.

## Affected products

- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

## Timeline

- 2026-06-03: disclosed
- 2026-06-03: advisory

## References

- [https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36611.md](https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36611.md)

## Related threats

- [Mercusys AC12G hardcoded WiFi credentials in firmware](https://junglewise.ai/threats/cve-2026-36616-mercusys-ac12g-hardcoded-wifi-credentials-in-firmware)
- [Mercusys AC12G information disclosure in /agileconfigreset endpoint](https://junglewise.ai/threats/cve-2026-36615-mercusys-ac12g-information-disclosure-in-agileconfigreset)
- [Mercusys AC12G V1 password recovery via static nonce and weak encoding](https://junglewise.ai/threats/cve-2026-36609-mercusys-ac12g-v1-password-recovery-via-static-nonce-and-weak)
- [Mercusys AC12G UPnP port forwarding to local admin interface](https://junglewise.ai/threats/cve-2026-36608-mercusys-ac12g-upnp-port-forwarding-to-local-admin-interface)
- [Mercusys AC12G hardcoded DES key in configuration backup](https://junglewise.ai/threats/cve-2026-36606-mercusys-ac12g-hardcoded-des-key-in-configuration-backup)