Mercusys AC12 V2 EUVD-2026-92785

Exploitation requires local access to the Mercusys AC12 V2 - either an on-device foothold (shell/serial/UART) or possession of the device firmware image from which the hardcoded 512-bit RSA private key can be extracted; the key is embedded in the firmware and shared across all units of this model. The primary LIMITING factors are: the local attack vector (AV:L) means no remote/internet exploitation and no automatable mass abuse (SSVC Automatable: no), and exploitation is constrained to this specific router model and firmware. No user interaction and no pre-existing authentication are required once local access is obtained (PR:N/UI:N). There is no confirmed active exploitation (not in CISA KEV), only a public advisory/POC.

This vulnerability presents a real but geographically/physically bounded risk rather than a mass-exploitation emergency. The CVSS vector (AV:L/AC:L/PR:N/UI:N) describes a local attack with low complexity and no required privileges, yielding high confidentiality and integrity impact but no availability impact (7.7, High). The local attack vector is the dominant limiting factor: an attacker needs local access to the device (shell, serial/UART, or extracted firmware) rather than remote network reach. SSVC corroborates this with Exploitation: poc, Automatable: no, and Technical Impact: total - meaning full compromise is possible but cannot be scaled in an automated internet-wide fashion. EPSS reinforces low urgency at 0.17% (6th percentile), consistent with a hardware/firmware flaw that is not remotely wormable. There is NO CISA KEV listing, so there is no confirmed active exploitation. A POC/advisory exists (SSVC=poc plus the ThreadPoolX GitBook advisory), so exploit knowledge is public. CONFLICT TO NOTE: the CWE is CWE-789 (Memory Allocation with Excessive Size Value), which does not match a 'hardcoded RSA private key' weakness - the correct mapping would be CWE-321 (Use of Hard-coded Cryptographic Key) or CWE-798; verify the CWE with the vendor/advisory. Also note the 512-bit RSA key length is cryptographically broken (factorable with modest resources), which makes the cryptographic-compromise aspect credible. Net: prioritize for affected device owners, but it is a high-CVSS, low-real-world-spread issue, not a widespread network emergency.

An attacker with local access to a Mercusys AC12 V2 router (or a copy of its firmware) extracts the hardcoded 512-bit RSA private key, which is identical across all units of the model. Because 512-bit RSA is trivially factorable and the key is shared, the attacker can impersonate the device, decrypt or forge the protected communications/firmware-signing it secures, and leverage that trust to execute arbitrary code on the device. A public advisory/POC exists (ThreadPoolX GitBook), lowering the effort required, though the local attack vector prevents remote, automated mass exploitation.