CVE-2026-36607: Mercusys AC12G Router TDDP Password Change Endpoint Rate Limit Bypass Leading to Unauthenticated Brute-Force

Vulnerability Overview CVE-2026-36607: Authentication Rate Limit Bypass via TDDP Password Change Endpoint MITRE Description: Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint. An attacker can attempt infinite password guesses on an adjacent network without triggering account lockout. Details: - The router's TDDP (TP-Link Device Debug Protocol) HTTP interface uses different numeric operation codes to execute various functions. - The login endpoint (code=7) locks the source IP for 2 hours after approximately 5 failed attempts. However, the password change endpoint (code=10) performs the same authentication checks but lacks any lockout mechanism. - This allows unlimited brute-forcing from any device on the LAN at network speed (approximately 700–1500 passwords per second). - The password encoding algorithm uses static XOR and hardcoded salts, completely replacing the password verification logic found in the router's JavaScript source code. - Administrator passwords are restricted to 6–32 printable ASCII characters. - Testing showed no lockout occurred after over 1,000,000 consecutive attempts. - When combined with CVE-2026-36604 (DNS rebinding/CORS wildcard), this vulnerability can be exploited from the internet via the victim's browser. Impact Scope Severity: Critical CVSS v3.1: - Score: 9.8 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE: - CWE-307: Improper Restriction of Excessive Authentication Attempts - CWE-287: Improper Authentication Affected Products: - Vendor: Mercusys (TP-Link sub-brand) - Product: AC12G (EU) V1 - Tested Firmwares: AC12G(EU)_V1_200909, AC12G(EU)_V1_210128 - Component: TDDP HTTP Authentication Handler, Password Change Endpoint (code=10) - Status: End of Life (No patch plan) Impact: - Full administrative access gained after successful brute-force attack - No lockout or detection mechanisms alert the user - Any LAN device (including compromised IoT devices) can execute this attack - Post-exploitation: DNS hijacking, firewall manipulation, WiFi credential extraction, firmware modification Remediation 1. Apply the same rate limiting to code=10 as is applied to code=7 2. Require an active, authenticated session before processing password change requests 3. Implement account lockout on all authentication validation endpoints Discoverer Tymbark7372 References https://github.com/Tymbark7372/MERCUSYS-AC12G

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-36607: Mercusys AC12G Router TDDP Password Change Endpoint Rate Limit Bypass Leading to Unauthenticated Brute-Force

More from this source