CVE-2026-36609 affects the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The vulnerability arises because the device uses a static authentication nonce that does not change between requests originating from the same source IP address. This static nonce, when combined with the predictable XOR-based password encoding implemented in the securityEncode function, allows an attacker who captures authentication tokens to reverse-engineer them and recover the plaintext password. This weakness relates to improper nonce management (CWE-341) and use of weak cryptographic primitives (CWE-327). There is no indication of an available patch or official fix, and no known exploits in the wild have been reported.

An attacker can capture authentication tokens from the affected router and, due to the static nonce and weak encoding, reverse these tokens to obtain the plaintext password. This compromises the confidentiality and integrity of the device's authentication mechanism, potentially allowing unauthorized access and control of the router. The CVSS score of 7.3 reflects a high impact with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of the router's management interface to untrusted networks and monitor for firmware updates from Mercusys addressing this issue.