CVE-2026-36605 affects the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The vulnerability allows an attacker to send a low number of specially crafted incomplete HTTP requests that trigger a denial of service condition. This results in a persistent crash of the device, which cannot recover without a physical power cycle. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (no confidentiality or integrity impact). No official patch or remediation guidance is currently available from the vendor.

Successful exploitation causes a denial of service by crashing the router, making it unavailable until physically power cycled. There is no impact on confidentiality or integrity. The attack can be performed remotely over the network without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, affected devices should be monitored for unusual HTTP traffic patterns and physical access should be controlled to allow power cycling if needed. Network-level protections such as filtering or rate limiting incomplete HTTP requests may help reduce exposure.