The firmware of the Mercusys AC12G (EU) V1 includes embedded WiFi driver credentials, a RADIUS shared secret, a WPS test key, and a default pre‑shared key. These hard‑coded credentials enable an attacker to authenticate to the device’s WiFi network without any user input and gain privileged access to the network and the device itself. Once authenticated, an attacker can intercept wireless traffic, add or modify network policies, or use the router as a foothold for further attacks. The nature of the flaw is a credential compromise that undermines network confidentiality and integrity.

Mercusys AC12G (EU) V1 firmware AC12G(EU)_V1_200909 is affected. No other product or version information was disclosed.

The EPSS score is not available, and the vulnerability is not listed in KEV, but the existence of hard‑coded credentials poses a high exploitation risk. An attacker with network access to the device can readily exploit the flaw by connecting to the WiFi network using the embedded credentials or by querying the device over the local network. Although a formal CVSS score is not provided, the risk remains significant because the attacker gains both network access and administrative control in one step.