Arbitrary Code Execution in Mercusys AC12 V2 via UART

Executive Summary

This vulnerability is a local code execution flaw in Mercusys AC12 V2 devices. It allows an attacker with physical access to the device via the UART serial interface on the PCB to run arbitrary commands.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires physical access to the device's UART interface on the PCB. It cannot be detected remotely via network commands. To check for exposure, inspect the router's PCB for unpopulated UART pins (usually labeled TX, RX, GND) and ensure no debug headers are accessible. If found, the device is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over the device, potentially intercepting network traffic, modifying settings, or using it as a foothold to attack other systems on the same network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated root-level access via an unprotected UART interface, enabling arbitrary code execution and full device compromise. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR and HIPAA requirements for data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Disable UART output in production firmware, enforce authentication for shell access, or remove debug headers if present. Implement physical access controls to prevent unauthorized disassembly. Network segmentation can limit potential damage if the device is compromised.

Useful 0 Not Useful 0