What is the CVSS score of CVE-2026-36602?

CVE-2026-36602 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Mercusys AC12G CVE-2026-36602

EUVD-2026-34141 MEDIUM

Information Exposure (CWE-200)

2026-06-03 mitre

GHSA-j3qc-9q9j-gxw3

Information Disclosure N A

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 04:33 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 03, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, revealing kernel memory layout and aiding further exploitation.

AnalysisAI

Kernel pointer disclosure in the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 allows unauthenticated adjacent-network attackers to obtain raw MIPS KSEG0 kernel addresses through the UPnP GetStatusInfo action, effectively defeating kernel address-space layout randomization on the device. The leaked pointer reveals the kernel memory map and is most useful as a precursor to a more severe exploit chain rather than as a standalone attack - its primary value is enabling reliable offset calculation for subsequent memory corruption attacks. No public exploit identified at time of analysis, EPSS is 0.02% (7th percentile), and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected device is a SOHO wireless router based on a MIPS architecture, running firmware AC12G(EU)_V1_200909. UPnP (Universal Plug and Play) is a protocol suite commonly enabled by default on consumer routers to allow LAN-side devices to auto-configure port forwarding and service discovery. The GetStatusInfo action is part of the UPnP WANIPConnection or WANCommonInterfaceConfig service definition. On this firmware, the response to that action inadvertently includes a raw kernel virtual address in the MIPS KSEG0 region (0x80000000-0x9FFFFFFF), which is a direct-mapped, non-cacheable segment used for kernel code and data. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies here: the firmware fails to sanitize its response before returning it over the UPnP interface, leaking a pointer that should never leave kernel space. CPE data provided by NVD is listed as 'n/a', meaning no structured CPE string has been assigned - exact affected scope is confirmed only through the researcher advisory.

RemediationAI

No vendor-released patch has been identified at time of analysis - no official Mercusys or TP-Link security advisory exists for this CVE. Users should check the Mercusys firmware download page for AC12G (EU) V1 for any firmware update newer than AC12G(EU)_V1_200909 and apply it if available, noting that changelog detail from consumer router vendors is often insufficient to confirm whether a specific CVE is addressed. As an immediate compensating control, disabling UPnP on the router administration interface eliminates the attack surface entirely; the trade-off is that LAN-side applications relying on UPnP auto-configuration (gaming consoles, media servers, certain VoIP clients) will require manual port forwarding rules. If UPnP cannot be disabled, restricting LAN-side access to the UPnP service port (UDP 1900 for SSDP discovery; TCP varies by implementation) via firewall ACLs on upstream network equipment reduces exposure to trusted hosts only. Physical network segmentation - placing untrusted or guest devices on an isolated VLAN without access to the router management plane - further limits who can reach the UPnP service. The advisory is at https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36602.md.