What is the CVSS score of EUVD-2026-34142?

EUVD-2026-34142 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mercusys AC12G are affected by EUVD-2026-34142?

Mercusys AC12G (EU) V1 routers can be exploited from within the organization's network to bypass firewall controls and expose network infrastructure details without requiring administrative…

How to fix or mitigate EUVD-2026-34142?

24 hours: Audit inventory to identify all Mercusys AC12G (EU) V1 routers running firmware AC12G(EU)_V1_200909. 7 days: Disable UPnP on affected devices if operationally feasible; if required, disable IGD service specifically and implement network access controls to restrict port 1900 access. 30 days: Contact Mercusys for patched firmware availability; plan device replacement if no fix is released.

Mercusys AC12G EUVD-2026-34142

| CVE-2026-36603 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-03 mitre

GHSA-w7xg-p523-gcw4

Authentication Bypass N A

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 04:30 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.1 (HIGH)

CVE Published

Jun 03, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.

AnalysisAI

Unauthenticated UPnP abuse in Mercusys AC12G (EU) V1 routers running firmware AC12G(EU)_V1_200909 allows any device on the LAN to invoke 15 of 18 UPnP IGD actions on port 1900, including AddPortMapping and GetExternalIPAddress, without authentication. Because UPnP is enabled by default, an attacker with adjacent network access can punch arbitrary holes through the WAN firewall and enumerate external network state. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but the misconfiguration is trivially abusable once on the LAN.

Technical ContextAI

The vulnerability lies in the router's implementation of the Universal Plug and Play Internet Gateway Device (UPnP IGD) profile, exposed via SSDP/SOAP on UDP/TCP port 1900. UPnP IGD is intended to let trusted LAN applications (game consoles, VoIP clients) request short-lived NAT port mappings, but the specification assumes the LAN itself is a trust boundary and provides no built-in authentication. The root cause maps to CWE-306 (Missing Authentication for Critical Function): security-sensitive actions like AddPortMapping (creates inbound NAT rules) and GetExternalIPAddress (discloses WAN-side information) are exposed without any credential check on 15 of the 18 documented IGD actions. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not concretely identify the device - the description and advisory text identify the Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 as the affected platform.

RemediationAI

No vendor-released patch identified at time of analysis; the Mercusys product security pages should be monitored for a firmware update superseding AC12G(EU)_V1_200909, and the researcher advisory at https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36603.md should be consulted for updates. The most effective compensating control is disabling UPnP in the router's admin interface, which removes the unauthenticated SOAP surface entirely at the cost of breaking applications that rely on automatic NAT traversal (some games, peer-to-peer voice/video, certain IoT pairings) - affected users would need to configure static port forwards manually. Where disabling UPnP is not acceptable, restrict who is on the LAN by segregating untrusted devices (guest SSID, IoT VLAN) so they cannot reach port 1900 on the gateway, and periodically audit the router's active port-mapping table for unexpected entries. Blocking inbound traffic to TCP/UDP 1900 from untrusted segments via firewall rules, where the device supports it, is a secondary mitigation but does not protect against an attacker already on the trusted LAN.