The Mercusys AC12G (EU) V1 router performs an unsafe validation in its UPnP AddPortMapping service, accepting the router’s own local IP address (192.168.1.1) and the loopback address (127.0.0.1) as an internal client. When an unauthenticated LAN attacker submits a single SOAP request, any external port can be mapped to the router’s administrative interface, effectively exposing the privileged web interface to the internet. This flaw allows an attacker to reach the router’s admin panel from outside the local network, potentially obtaining configuration data, modifying settings, or executing commands with full administrative privileges.

Mercusys AC12G (EU) V1 router, firmware AC12G(EU)_V1_200909. No other manufacturer or model numbers were listed in the advisory.

The vulnerability does not list an EPSS score or KEV status, indicating that data on real-world exploitation is currently unavailable. The CVSS score of 8.8 indicates high severity. However, the attack path requires an active LAN presence and an unauthenticated SOAP request to the UPnP service, which are common in many small home and small office networks. Once the port mapping is created, the attacker can access the router’s admin panel from the wider internet, a high‑impact consequence that can lead to full device compromise. Given the ease of exploitation and the severe potential impact, the risk is considered moderate to high.