CVE-2026-36603 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909. The router exposes 15 out of 18 UPnP IGD actions without requiring authentication on port 1900. Since UPnP is enabled by default via the admin interface, any unauthenticated device on the LAN can invoke sensitive actions such as AddPortMapping and GetExternalIPAddress. This allows unauthorized creation of port forwarding rules and access to WAN traffic statistics, potentially compromising network security. The CVSS score is 8.1 (high severity), indicating a significant risk if exploited. No patch or official remediation is currently documented.

An unauthenticated attacker on the local network can manipulate the router's UPnP IGD interface to create arbitrary port forwarding rules, potentially exposing internal services to the internet. Additionally, the attacker can retrieve WAN traffic statistics and external IP information. This compromises confidentiality and integrity of network configuration and could facilitate further attacks. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable UPnP on the router if possible or restrict LAN device access to the router's management interface. Network administrators should monitor for unauthorized port mappings and consider network segmentation to limit exposure of critical devices.