The vulnerability permits an unauthenticated attacker on the same local network to invoke the UPnP GetStatusInfo action on a Mercusys AC12G (EU) V1 router. The router inadvertently returns a raw MIPS KSEG0 kernel pointer, exposing the kernel memory layout. This information disclosure can facilitate further exploitation by allowing an attacker to compute addresses of kernel objects or code sections, increasing the likelihood of successful privilege escalation or compromise.

Affected devices include Mercusys AC12G (EU) V1 routers running firmware version AC12G(EU)_V1_200909. The flaw is specific to this firmware build and requires the device to expose its UPnP interface to the adjacent network.

Because the flaw is limited to local network access and requires no credentials, the attack vector is local. The EPSS score is less than 1%, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 4.3 indicates a medium impact. The disclosure of a kernel pointer can accelerate subsequent attacks, implying a medium risk level pending vendor response.