The vulnerability arises from the router’s use of a hardcoded DES key and single DES in ECB mode to encrypt configuration backups. This weak encryption scheme allows an attacker who obtains a backup file to decrypt it and recover all credentials stored within, including the admin password, WiFi PSK, and DDNS credentials. The root weakness involves the use of a hardcoded DES key (CWE-798). Based on available information, it is inferred that an attacker could obtain the backup file through the router’s web interface or by physical access.

Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909.

The attack requires access to the backup file, which can be obtained through the router’s web interface or by physical access. The CVSS score of 7.1 indicates moderate‑to‑high severity for sensitive data exposure, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The potential impact is significant for networks where the backup contains credentials that could compromise the router, neighboring devices, or the broader network domain.