CVE-2026-36610 identifies a vulnerability in Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909 where DDNS credentials are sent over unencrypted HTTP with only Base64 encoding. The absence of TLS means that these credentials can be intercepted by attackers positioned on the network path, enabling credential disclosure. The vulnerability affects the firmware's DDNS service communication and does not currently have an official remediation or patch. There is no CVSS score assigned, and no known exploits in the wild have been reported.

The vulnerability allows an attacker with network access to intercept DDNS service credentials due to transmission over plaintext HTTP with only Base64 encoding. This compromises the confidentiality of DDNS credentials, potentially enabling unauthorized access or manipulation of DDNS settings. No further impact details or exploitation reports are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the affected firmware version or consider disabling DDNS functionality if possible. Network-level protections such as using trusted networks or VPNs may reduce exposure but do not fully mitigate the vulnerability.