CVE-2026-36603

The Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 is vulnerable to an authentication bypass. The device exposes 15 of 18 UPnP IGD actions without authentication on port 1900 , including AddPortMapping and GetExternalIPAddress. Because UPnP is enabled by default via the admin ...