CVE-2026-36608 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909 where the UPnP AddPortMapping feature improperly accepts the router's own IP addresses (192.168.1.1 or 127.0.0.1) as valid InternalClient values. This allows an unauthenticated attacker on the LAN to create port forwarding rules that expose the router's administrative interface to the internet. The vulnerability is classified under CWE-441 (Improper Handling of Internal IP Addresses) and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. There is no known patch or vendor remediation at this time, and no known exploits in the wild have been reported.

An unauthenticated attacker on the local network can exploit this vulnerability to expose the router's administrative interface to the internet by forwarding external ports to the router itself. This exposure can lead to full compromise of the router, including unauthorized configuration changes, credential theft, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the device and potentially the network it protects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the local network to trusted users only and consider disabling UPnP functionality on the router if possible to prevent exploitation of the AddPortMapping feature.