EUVD-2026-34147
GHSA-2q23-65hh-rjx9
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.
AnalysisAI
Unauthenticated LAN-to-WAN admin panel exposure in Mercusys AC12G (EU) V1 routers running firmware AC12G(EU)_V1_200909 allows any device on the local network to publish the router's own administrative interface to the public internet via a single UPnP SOAP request. Because the device fails to reject loopback and its own LAN IP as the InternalClient in AddPortMapping requests, an attacker can pivot a temporary LAN foothold into a permanent, internet-reachable management plane exposure. No public exploit is identified at time of analysis, but the technique is trivial and well-documented in the referenced advisory.
Technical ContextAI
The flaw lives in the router's UPnP IGD (Internet Gateway Device) implementation, which exposes a SOAP endpoint for WANIPConnection:AddPortMapping so that LAN clients (typically games, P2P apps, VoIP) can request inbound NAT pin-holes. CWE-441 (Unintended Proxy or Intermediary, 'Confused Deputy') applies because the router accepts InternalClient values pointing to itself - 192.168.1.1 (its own LAN gateway IP) or 127.0.0.1 (loopback) - and dutifully forwards a chosen WAN port to its own HTTP(S) administration service. A correctly hardened UPnP stack would refuse mappings whose InternalClient resolves to the gateway itself or to localhost, as recommended in UPnP IGD security guidance and RFC 6886/6887 implementation notes. The CPE field in the source data is a placeholder (cpe:2.3:a:n/a:n/a) and does not enumerate the actual product, so identification relies on the description and advisory; the affected device is the Mercusys AC12G (EU) V1 hardware revision running firmware build AC12G(EU)_V1_200909.
RemediationAI
No vendor-released patch identified at time of analysis - neither Mercusys' advisory page nor a fixed firmware build is referenced in the available data, so monitor the Mercusys support site for an AC12G(EU)_V1 firmware update superseding AC12G(EU)_V1_200909 and apply it as soon as published. As compensating controls, disable UPnP entirely in the router's NAT/Forwarding configuration (side effect: games, console NAT type, VoIP, and some P2P applications may require manual port forwarding); if UPnP must remain enabled, segment untrusted devices onto the guest SSID (which on Mercusys is typically isolated from the LAN and from the management interface) so they cannot reach the UPnP SOAP endpoint; additionally restrict the WAN-side admin interface by disabling 'Remote Management' and changing the admin port from defaults so that any mapping created by exploitation is less directly useful, and rotate the admin password since prior compromise via this vector cannot be ruled out. Reference advisory: https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36608.md.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today