CVE-2026-36609 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware version AC12G(EU)_V1_200909. The router uses a static authentication nonce for requests originating from the same source IP address. Because the nonce does not vary, and the password encoding relies on a predictable XOR-based function (securityEncode), an attacker who captures authentication tokens can reverse the encoding to obtain the plaintext password. This flaw compromises the confidentiality of authentication credentials.

An attacker able to capture authentication tokens from the affected router can recover the plaintext password due to the static nonce and weak encoding scheme. This could lead to unauthorized access to the router's administrative interface. No information is provided about exploitation in the wild or additional impact details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, users should consider restricting access to the router's management interface and monitoring for unusual activity.