CVE-2026-36607 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909. The issue arises because the TDDP password change endpoint (code=10) lacks rate limiting controls that are present on the login endpoint (code=7). This allows an unauthenticated attacker on the adjacent network to perform unlimited brute-force password attempts without account lockout, potentially compromising device access.

An attacker on the adjacent network can perform unlimited brute-force attempts against the router's password change endpoint without triggering lockout mechanisms. This could lead to unauthorized access or control over the device if the attacker successfully guesses the password. However, no known exploits are currently reported in the wild, and the extent of compromise depends on the attacker's ability to guess credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should restrict access to the router's management interfaces to trusted networks only and monitor for unusual authentication attempts. Applying network segmentation to isolate the device from untrusted adjacent networks can reduce exposure.