CVE-2026-36607EPSS p7.8%

CVE-2026-36607CVE-2026-36607

Description

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.

Scoring

CVSS 8.8 ()
VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.18% probability of exploitation · percentile 7.8% · 2026-06-19T12:03:05Z
Last modified2026-06-04

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-36609
CVE
CVE-2026-36605
CVE
CVE-2026-36612
CVE
CVE-2026-36615
CVE
CVE-2026-36616
CVE
CVE-2026-36606
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.