CVE-2026-36606 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909, where configuration backups are encrypted using a hardcoded DES key with single DES in ECB mode. Because the encryption key is hardcoded and weak, an attacker who obtains a backup file can decrypt it to retrieve all stored credentials, including the administrator password, WiFi pre-shared key, and DDNS credentials. The CVSS score is 7.1 (high), with attack vector local, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impact. No patch or official remediation is currently documented.

An attacker with local access to a configuration backup file can decrypt it to recover sensitive credentials, including the admin password, WiFi PSK, and DDNS credentials. This compromises the confidentiality and integrity of the device's configuration and potentially allows unauthorized access and control over the router and connected network resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid creating or distributing configuration backups in untrusted environments and restrict access to backup files. Consider changing credentials after backup file exposure and monitor for unauthorized access.