# CVE-2026-36613: Mercusys AC12G Information Disclosure in HTTP Server

Source: https://junglewise.ai/threats/cve-2026-36613-mercusys-ac12g-information-disclosure-in-http-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-36613 · Severity: info · CVSS 5.3 · Published 2026-06-03

The Mercusys AC12G wireless router contains a security flaw in its web management interface. When the router receives a specific type of network request to a non-existent page, it accidentally responds with fragments of its internal memory instead of an error message. This could allow an attacker on the same local network to see sensitive technical data or information from previous user sessions, potentially aiding in more complex attacks.

Technologies: [Mercusys AC12G (EU) V1](https://junglewise.ai/threats/technologies/ac12g-eu-v1). Vendors: [Mercusys](https://junglewise.ai/threats/vendors/mercusys).

## Quick answers

**Is CVE-2026-36613 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36613 being exploited in the wild.

**How severe is CVE-2026-36613?** Informational severity, with a CVSS score of 5.3, published 3 June 2026.

**Which products and versions are affected?** Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

**Is there a fix for CVE-2026-36613?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36613 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-36613?** Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The VxWorks-based HTTP server on affected Mercusys AC12G routers fails to return standard HTTP error responses (like 404 Not Found) for unrecognized request paths or invalid TDDP operation codes. Instead, the server responds with 128 bytes of raw internal memory from the header parsing buffer. If a POST body is included, the device performs an out-of-bounds read, leaking an additional 67 bytes from adjacent heap memory. This vulnerability allows an unauthenticated attacker on the adjacent network (LAN) to capture internal server state and fragments of previous HTTP operations. Because the device lacks ASLR, any leaked memory addresses are stable, which may facilitate further exploitation. No fix is planned as the product is reportedly end-of-life.

## Affected products

- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

## Timeline

- 2026-06-03: disclosed: Initial disclosure and NVD publication

## References

- [https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36613.md](https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36613.md)

## Related threats

- [Mercusys AC12G information disclosure in DNS resolver](https://junglewise.ai/threats/cve-2026-36618-mercusys-ac12g-information-disclosure-in-dns-resolver)
- [Mercusys AC12G weak WPS lockout and predictable PIN](https://junglewise.ai/threats/cve-2026-36612-mercusys-ac12g-weak-wps-lockout-and-predictable-pin)
- [Mercusys AC12G cleartext transmission of DDNS credentials](https://junglewise.ai/threats/cve-2026-36610-mercusys-ac12g-cleartext-transmission-of-ddns-credentials)
- [Mercusys AC12G brute-force protection bypass in TDDP endpoint](https://junglewise.ai/threats/cve-2026-36607-mercusys-ac12g-brute-force-protection-bypass-in-tddp-endpoint)
- [Mercusys AC12G DNS rebinding via missing Host header validation](https://junglewise.ai/threats/cve-2026-36604-mercusys-ac12g-dns-rebinding-via-missing-host-header-validation)