The firmware of the Mercusys AC12G (EU) V1 embeds WiFi driver credentials, a RADIUS shared secret, a WPS test key, and a default pre‑shared key. Based on the description, it is inferred that an attacker with wireless access can use these hard‑coded secrets to authenticate to the device’s WiFi network and then interact with the router or the local subnet. This compromise can lead to interception of wireless traffic, alteration of network policies, and potential use of the router as a foothold for further attacks on the local network. The vulnerability represents a moderate‑risk flaw as denoted by its CVSS score of 5.9, underscoring the importance of credential protection.

Mercusys AC12G (EU) V1 firmware version AC12G(EU)_V1_200909 is affected. No other vendor or product variants were disclosed in the advisory.

The EPSS score of <1% indicates a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. The CVSS score of 5.9 denotes moderate severity. Based on the description, the attacker must be within wireless range of the device to utilize the hard‑coded credentials. Once connected, the attacker can access the router’s management interface or local network resources, achieving both network access and the potential for administrative control in a single step.