EUVD-2026-34144
GHSA-j2fc-v5xj-h5gr
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, causing a persistent crash that requires physical power cycling to recover.
AnalysisAI
Persistent denial-of-service in the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 allows an unauthenticated adjacent-network attacker to crash the device by sending a low number of crafted, incomplete HTTP requests, rendering it unresponsive until physically power-cycled. The attack exploits uncontrolled resource consumption (CWE-400) in the router's HTTP service, which fails to safely handle malformed or truncated connections. No public exploit code or active exploitation has been identified at time of analysis, and SSVC signals confirm exploitation status as none.
Technical ContextAI
The vulnerability resides in the HTTP server component embedded in the Mercusys AC12G (EU) V1 router's firmware (AC12G(EU)_V1_200909). CWE-400 (Uncontrolled Resource Consumption) indicates the HTTP handler does not enforce limits on incomplete or stalled connections - likely holding sockets, threads, or memory allocations open without timeout or cleanup logic. A small number of such requests is sufficient to exhaust the available handler capacity, crashing the service and the device itself in a non-recoverable state (persistent crash requiring physical power cycling). The CVSS attack vector of Adjacent Network (AV:A) reflects that the router's HTTP management interface is typically reachable from LAN-side clients rather than the open internet, though guest networks or other adjacent segments may also provide access. CPE data provided (cpe:2.3:a:n/a:n/a) is non-informative and the specific product scope is established solely by the researcher advisory and MITRE report.
RemediationAI
No vendor-released patch has been identified at time of analysis; the only public reference is a researcher-published GitHub advisory, not a vendor security bulletin. Administrators should monitor the Mercusys official support portal for firmware updates addressing this issue and apply any released patch immediately. In the interim, a practical compensating control is to restrict access to the router's HTTP management interface to a specific trusted IP or MAC address using the router's built-in access control features, preventing arbitrary LAN-side clients from reaching the web interface - note this may limit remote administration convenience. Where possible, disabling the HTTP management interface entirely and relying solely on local console access reduces the attack surface, though this eliminates web-based management. Network segmentation to isolate untrusted LAN devices (e.g., IoT devices, guest clients) from reaching the router's management plane is the most broadly effective compensating measure. Physical access controls to facilitate rapid power cycling are advisable for devices in unattended deployments where recovery time is a concern.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today