Is CVE-2026-36612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36612 being exploited in the wild.

How severe is CVE-2026-36612?

Informational severity, with a CVSS score of 6.5, published 3 June 2026.

Which products and versions are affected?

Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

Is there a fix for CVE-2026-36612?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36612 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-36612?

Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36612: Mercusys AC12G weak WPS lockout and predictable PIN

CVE-2026-36612 · Severity: info · CVSS 6.5 · Published 2026-06-03

The Mercusys AC12G wireless router contains a security flaw in its Wi-Fi Protected Setup (WPS) feature, which is used to easily connect devices to Wi-Fi. The device uses a predictable security PIN based on its hardware address and does not sufficiently block repeated incorrect guesses. If an attacker is within range and the WPS feature is activated, they could quickly guess the PIN to gain unauthorized access to the home or office network and its connected devices.

Technologies: Mercusys AC12G (EU) V1. Vendors: Mercusys.

Quick answers

Is CVE-2026-36612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36612 being exploited in the wild.
How severe is CVE-2026-36612?: Informational severity, with a CVSS score of 6.5, published 3 June 2026.
Which products and versions are affected?: Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.
Is there a fix for CVE-2026-36612?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36612 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-36612?: Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mercusys AC12G (EU) V1 router (firmware versions 200909 and 210128) implements WPS 2.0 with insecure defaults. The AP PIN is deterministically derived from the BSSID MAC address using a known Ralink/MediaTek algorithm, making it predictable to attackers. Furthermore, the device's lockout policy is insufficient, only triggering a 60-second lockout after 10 failed attempts. While WPS 2.0 requires user activation (via button or UI) for the PIN exchange, an attacker within radio range can exploit the predictable PIN to gain immediate access to the WPA/WPA2 credentials once the session is active. No fix is planned as the product is reportedly end-of-life.

Affected products

Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

Timeline

2026-06-03: disclosed: Initial disclosure via GitHub and NVD publication.

References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36612.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.