The Mercusys AC12G (EU) V1 router with firmware version AC12G(EU)_V1_200909 is vulnerable to information disclosure due to returning 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths. This allows unauthenticated attackers on the same or adjacent network to potentially access sensitive server state information. The vulnerability is confirmed published but lacks a CVSS score and no remediation level or patch information is provided.

The vulnerability results in unintended disclosure of internal server memory contents, which may include sensitive information about the device state. This exposure could aid attackers in further reconnaissance or exploitation efforts. However, there is no indication of active exploitation or direct compromise beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device management interface to trusted networks only and monitor for unusual HTTP POST requests to undefined paths.