Mercusys AC12G CVE-2026-36613: Uninitialized Buffer Disclosure on Undefined HTTP Paths

Vulnerability Overview CVE ID: CVE-2026-36613 Vulnerability Name: HTTP POST Uninitialized Buffer Disclosure on Undefined Paths Description: The Mercusys AC12G (EU) V1 firmware returns the contents of a 128-byte uninitialized internal buffer when receiving HTTP POST requests on undefined paths, leading to server state exposure to unauthenticated adjacent network attackers. Affected Scope Affected Products: - Vendor: Mercusys (a sub-brand of TP-Link) - Product: AC12G (EU) V1 - Tested Firmwares: AC12G(EU)_V1_200909, AC12G(EU)_V1_210128 - Components: HTTP Server, POST request handler for undefined paths - Status: End of Life (no fix planned) Trigger Conditions: - POST /?code=N, where N is outside the range of valid handlers (e.g., code=32 to code=65535) - POST /admin, POST /config, POST /firmware, or any other unrecognized paths Leaked Content: - The leaked 128-byte header buffer contains: - When a POST body is included, the response also reads 67 bytes from adjacent heap memory, exceeding the POST body buffer boundaries, resulting in the leakage of HTTP response template fragments. Severity: - Medium - CVSS v3.1 Score: 5.3 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE Classification: - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - CWE-125: Out-of-bounds Read Remediation 1. Return appropriate HTTP error codes (400/404/405) for unrecognized paths and invalid operation codes. 2. Do not include internal parsing buffers in the response. 3. Validate output buffer boundaries before sending response data. Discoverer Tym bark7372 References GitHub Link

Goal Reached Thanks to every supporter — we hit 100%!

Mercusys AC12G CVE-2026-36613: Uninitialized Buffer Disclosure on Undefined HTTP Paths

More from this source