Mercusys AC12 CVE-2026-78862

Exploitation requires direct physical access to the device's printed circuit board and the ability to open the enclosure and electrically connect to the UART serial debug header (AV:P). The UART interface is unprotected (no authentication gate), consistent with CWE-1299, so once physical contact is made no credentials are needed. Limiting factors: the attacker must be physically present with the hardware disassembled and must have a serial adapter and wiring to the correct pins; the flaw cannot be triggered over the network, Wi-Fi, or LAN, making remote or at-scale exploitation infeasible. Realistic exposure is confined to supply-chain, device-resale, lost/stolen device, or evil-maid scenarios.

This is a high-CVSS-but-low-real-world-risk issue for the vast majority of deployments. The provided CVSS vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) is internally consistent with the description: the decisive constraint is AV:P (Physical) - an attacker must have hands-on access to the device's printed circuit board to reach the UART serial interface. Although impact is rated High across confidentiality, integrity, and availability (full code execution), the physical-access precondition severely limits scalability. Corroborating signals align: EPSS is 0.16% (4th percentile), among the lowest tiers, indicating negligible predicted mass-exploitation; the CVE is NOT in CISA KEV; and no public exploit code is referenced. No SSVC decision data was supplied. There is no conflict between the signals - CVSS physical vector, near-zero EPSS, and absent KEV all point the same direction: a genuine but low-urgency hardware/debug-interface weakness relevant mainly to supply-chain, evil-maid, or lab/teardown threat models rather than remote attack. Note the single reference advisory (threadpoolx gitbook) is third-party research, not a Mercusys vendor advisory, so affected-version and fix data remain unconfirmed.

An attacker with physical possession of a Mercusys AC12 V2 router (e.g., during an evil-maid scenario, device resale, or interdiction) opens the enclosure, attaches a USB-to-serial adapter to the exposed UART header on the PCB, and gains an unauthenticated debug console to execute arbitrary code on the device. No public exploit code is identified at time of analysis; the only reference is a third-party security advisory describing the unprotected debug interface. Attack complexity is low once physical access is achieved (AV:P/AC:L).