The vulnerability arises from the router’s use of a hardcoded DES key and Single DES in ECB mode to encrypt configuration backups. This weak encryption scheme allows an attacker who obtains a backup file to decrypt the backup and recover all credentials stored within, including the admin password, WiFi pre‑shared key, and DDNS credentials. The root weakness is the use of a hardcoded key (CWE‑256) in a weak cipher mode (CWE‑310), which directly leads to confidential information disclosure (CWE‑200).

Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909.

The attack requires that the attacker obtain a backup file. While the CVSS score is not disclosed, the exposure of all stored credentials indicates a high potential impact if the file is accessed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can read or download the backup via the router’s management interface or by physical access to the backup file. Given the severe information disclosure, the potential for compromise is significant, particularly if the router is part of a critical or exposed network environment.