Mercusys AC12 V2 Plaintext Credential Storage Arbitrary Code Execution

Executive Summary

CVE-2026-78860 is a high-severity vulnerability affecting the Mercusys AC12 V2 wireless router. It involves missing firmware encryption and a lack of secure boot mechanisms, allowing physical or local attackers to exploit the device through unprotected SPI flash storage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires physical access to the device and cannot be detected remotely. Check if your Mercusys AC12 V2 runs firmware version ac12v2-up_2020-09-03 or earlier. Use a CH341A SPI flash programmer with a SOP8 test clip to inspect the SPI flash memory for unencrypted data or unauthorized modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker with physical access can dump flash memory to extract plaintext credentials, flash malicious firmware for persistent code execution, modify credentials, install backdoors, or brick the device by overwriting the bootloader.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows physical attackers to extract plaintext credentials and modify firmware, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection requirements for secure storage and HIPAA's safeguards for protected health information if the device processes such data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware to the latest version if available. Physically secure the router in a restricted area to prevent unauthorized access. Consider replacing the device if no secure firmware update is provided, as the lack of encryption and secure boot cannot be fully mitigated without manufacturer intervention.

Useful 0 Not Useful 0