CVE-2026-36616 identifies a vulnerability in the Mercusys AC12G (EU) V1 router firmware version AC12G(EU)_V1_200909, where hardcoded WiFi driver credentials are embedded in the production firmware binary. These credentials include a RADIUS shared secret, a WPS test key, and a default pre-shared key (PSK). The vulnerability arises from the inclusion of these static secrets in the firmware, which could be extracted by an attacker with access to the firmware image. No CVSS score or remediation details are provided, and no known exploits have been reported.

The exposure of hardcoded WiFi credentials can lead to unauthorized network access if an attacker obtains the firmware and extracts these secrets. This compromises the confidentiality and integrity of the affected network's WiFi authentication mechanisms. However, no active exploitation has been reported, and the impact depends on whether these credentials are used in deployed devices and remain unchanged.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider replacing affected devices or disabling vulnerable features if possible. Monitoring vendor communications for firmware updates addressing this issue is recommended.