An issue in the Mercusys AC12 V2 router allows a local attacker to execute arbitrary code due to the storage of information in plaintext. This flaw could compromise the device and any network traffic it manages.

The affected product is the Mercusys AC12 V2 router. No specific firmware revision numbers are disclosed, but the vulnerability applies to devices running the V2 firmware.

The vulnerability requires local access, so an attacker on the local network or with physical proximity could trigger code execution. The EPSS score of less than 1% indicates a very low probability of exploitation, while the CVSS score of 7.8 reflects high severity. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation would allow the attacker to run arbitrary code on the router.