This vulnerability exposes 15 of 18 UPnP IGD actions on the Mercusys AC12G router without authentication. An unauthenticated device on the local network can issue AddPortMapping or GetExternalIPAddress requests, allowing the creation of arbitrary port forwarding rules and access to WAN traffic information. The lack of a login or authorization check for these actions makes the router’s network configuration easily manipulable by any LAN host.

Mercusys AC12G U‑PnP enabled routers running firmware AC12G(EU)_V1_200909 are affected. The router’s default configuration enables UPnP, so the issue exists out of the box.

The CVSS score of 8.1 indicates high severity. The EPSS score is 0.00022, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, so no official exploitation statistics exist. However, the attack requires only a presence on the local network; any device can send UPnP requests to port 1900. Because no authentication is enforced, exploitation is straightforward for a local attacker and the potential impact includes unauthorized port exposure and visibility into WAN traffic.