CVE-2026-36612

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).

Published 2026-06-03. Last modified 2026-07-22.