CVE-2026-36608 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909 where the UPnP AddPortMapping feature improperly accepts the router's own IP (192.168.1.1) or localhost (127.0.0.1) as the internal client. This enables an unauthenticated attacker on the LAN to forward external ports to the router's admin interface, exposing it to the internet via a single SOAP request. No CVSS score or remediation details are provided.

An unauthenticated attacker with local network access can expose the router's administrative interface to the internet, potentially allowing unauthorized remote access to router management functions. This could lead to compromise of the router and network configuration. There is no information about known exploits in the wild or confirmed impact beyond exposure of the admin panel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict UPnP access on the local network and consider disabling UPnP if not required. Network segmentation to limit LAN attacker access may reduce risk. Monitor vendor channels for updates or patches addressing this vulnerability.