# CVE-2026-36616: Mercusys AC12G hardcoded WiFi credentials in firmware

Source: https://junglewise.ai/threats/cve-2026-36616-mercusys-ac12g-hardcoded-wifi-credentials-in-firmware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-36616 · Severity: info · CVSS 6.1 · Published 2026-06-03

The Mercusys AC12G wireless router contains hardcoded development credentials and test keys within its production firmware. An attacker within wireless range could potentially impersonate authentication servers or gain unauthorized access to the network if the device reverts to these insecure default settings. This poses a risk to the privacy of the network traffic and the overall security of the connected environment.

Technologies: [Mercusys AC12G](https://junglewise.ai/threats/technologies/ac12g). Vendors: [Mercusys](https://junglewise.ai/threats/vendors/mercusys).

## Quick answers

**Is CVE-2026-36616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36616 being exploited in the wild.

**How severe is CVE-2026-36616?** Informational severity, with a CVSS score of 6.1, published 3 June 2026.

**Which products and versions are affected?** Mercusys AC12G AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

**Is there a fix for CVE-2026-36616?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36616 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-36616?** Check whether you run Mercusys AC12G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from the inclusion of development and test credentials (CWE-798) within the MediaTek/Ralink WiFi driver configuration template of the production firmware binary. Specifically, the firmware includes a hardcoded RADIUS shared secret ('ralink'), a WPS test key ('scaptest'), and a default AP Client PSK ('12345678'). These credentials may become active if configuration fails or if specific wireless modes are enabled without explicit user-defined keys. Additionally, the firmware contains format strings that log WiFi keys in plaintext to debug or serial outputs, further risking credential exposure. The product is reportedly end-of-life, and no official patch is expected.

## Affected products

- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

## Timeline

- 2026-06-03: advisory: NVD and researcher advisory published

## References

- [https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36616.md](https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36616.md)

## Related threats

- [Mercusys AC12G information disclosure in /agileconfigreset endpoint](https://junglewise.ai/threats/cve-2026-36615-mercusys-ac12g-information-disclosure-in-agileconfigreset)
- [Mercusys AC12G uninitialized buffer disclosure in UPnP](https://junglewise.ai/threats/cve-2026-36611-mercusys-ac12g-uninitialized-buffer-disclosure-in-upnp)
- [Mercusys AC12G V1 password recovery via static nonce and weak encoding](https://junglewise.ai/threats/cve-2026-36609-mercusys-ac12g-v1-password-recovery-via-static-nonce-and-weak)
- [Mercusys AC12G UPnP port forwarding to local admin interface](https://junglewise.ai/threats/cve-2026-36608-mercusys-ac12g-upnp-port-forwarding-to-local-admin-interface)
- [Mercusys AC12G hardcoded DES key in configuration backup](https://junglewise.ai/threats/cve-2026-36606-mercusys-ac12g-hardcoded-des-key-in-configuration-backup)