This vulnerability concerns the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909, which enables Wi-Fi Protected Setup (WPS) version 2.0 by default. The device enforces a lockout policy after 10 failed WPS attempts, but the lockout duration is only 60 seconds, which is considered weak. This weak lockout policy may allow attackers to perform repeated WPS PIN attempts with minimal delay, potentially facilitating brute-force attacks against the WPS PIN. No CVSS score or vendor remediation information is available, and no exploits have been reported in the wild.

The weak lockout policy on WPS 2.0 allows an attacker to attempt multiple WPS PIN authentications with only a short 60-second lockout after 10 failed attempts. This could increase the likelihood of successful brute-force attacks against the WPS PIN, potentially leading to unauthorized network access. However, no known exploits have been reported, and the actual impact depends on attacker capabilities and network configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling WPS on the affected device if possible to mitigate the risk associated with the weak lockout policy.