The Mercusys AC12G (EU) V1 device with firmware version AC12G(EU)_V1_200909 has hardcoded credentials embedded in its WiFi driver. These credentials include a RADIUS shared secret, a WPS test key, and a default pre-shared key (PSK). The presence of these hardcoded secrets (CWE-798) and improper control of authentication credentials (CWE-1188) can lead to unauthorized disclosure of sensitive information. The vulnerability has a CVSS v3.1 base score of 5.9, with attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. There is no known exploit in the wild and no vendor patch or remediation level has been published.

An attacker with access to the adjacent network could potentially extract the hardcoded credentials from the firmware binary, compromising WiFi authentication mechanisms. This could lead to unauthorized network access or interception of network traffic. The confidentiality impact is high due to exposure of sensitive credentials, but integrity and availability impacts are low or none.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider network segmentation and restricting access to trusted devices only. Avoid deploying the affected firmware version in sensitive environments if possible.