A hardcoded 512‑bit RSA private key embedded in Mercusys AC12 V2 firmware allows a local attacker to run arbitrary code on the device. The bug originates from the misuse of a fixed cryptographic key that can be extracted or used directly, bypassing authentication mechanisms and enabling execution of commands with the privileges of the firmware process. This flaw provides full control over the device’s operating environment and could be leveraged to modify network traffic, install malware, or create backdoors.

The vulnerability exists in Mercusys AC12 V2 routers. Specific firmware releases of this model contain the hardcoded key; other models or firmware versions not listed are presumed unaffected, though no explicit version matrix is available.

The flaw permits remote code execution only after local physical or logical access to the device, so it is not exploitable over the network without prior compromise. CVSS score is 7.7, and the EPSS score is < 1%, but the presence of a hardcoded private key indicates a high severity local vulnerability. Current advisories do not list this issue in the CISA KEV catalog, and no dedicated exploit has been documented publicly. An attacker who gains local access, such as through a physical console or compromised management interface, can exploit the vulnerability with relative ease, making it a significant risk for devices exposed to insider threats or unsecured facilities.