The vulnerability identified as CVE-2026-36615 affects Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909. It involves an undocumented endpoint, /agileconfigreset, which returns internal buffer contents without requiring authentication. The flaw is exploitable by attackers on the adjacent network, potentially exposing sensitive internal data. There is no information on patches or vendor advisories at this time, and no known exploits have been reported in the wild.

An unauthenticated attacker on the adjacent network can access internal buffer contents via the undocumented /agileconfigreset endpoint. This may lead to information disclosure that could assist further attacks or compromise device confidentiality. The exact nature and sensitivity of the exposed data are not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's local network and monitor for unusual activity. Avoid exposing the device to untrusted adjacent networks.