Hardcoded RSA Private Key in Mercusys AC12 V2

Executive Summary

CVE-2026-78861 is a high-severity vulnerability in the Mercusys AC12 V2 wireless router. It involves a hardcoded 512-bit RSA private key embedded in the device's firmware, which is identical across all units. This static key allows local attackers to extract it and bypass cryptographic protections, leading to unauthorized access or code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Mercusys AC12 V2 router is running firmware version ac12v2-up_2020-09-03 or earlier. Use firmware analysis tools like binwalk to extract the filesystem and locate the hardcoded priv-key.pem file in the web server's resource partition.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to decrypt administrative communications, hijack sessions, perform Man-in-the-Middle attacks on HTTPS/TLS traffic, forge authentication to gain admin access, or execute arbitrary code. The weak 512-bit key is easily factorable, making exploitation feasible even without physical access to the device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with standards like GDPR and HIPAA due to the exposure of a hardcoded cryptographic key. Weak cryptography allows attackers to decrypt sensitive communications, leading to unauthorized access to protected data. GDPR requires strong encryption for personal data, while HIPAA mandates secure transmission of health information. The flaw violates these requirements by enabling cryptographic bypass and information disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router firmware to the latest version if available. If no update exists, isolate the device from untrusted networks, disable remote management interfaces, and assume local traffic may be intercepted. Contact Mercusys support for a patched firmware release.

Useful 0 Not Useful 0