An issue in Mercusys AC12 V2 permits a local attacker with physical access to the printed circuit board to send crafted commands over the UART serial interface, leading to arbitrary code execution on the device. The flaw enables the attacker to control the operating environment of the AC12, potentially compromising the device’s confidentiality, integrity, and availability by allowing the installation of malicious firmware or the execution of arbitrary system commands. The vulnerability is identified as a form of code injection or insufficient interface protection, exposing the device to severe risk if an attacker can reach the UART port.

Mercusys AC12 V2 router models that expose an unprotected UART serial interface on the PCB. No specific firmware or hardware revision numbers are provided in the CNA data, but the vulnerability applies to all currently shipping units that have the UART debug port accessible.

The CVSS score is 6.8, but the description indicates that local physical access allows for full code execution, a high‑severity scenario. The EPSS score is 0.00159, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local physical attack where an adversary plugs a UART cable into the hardware; no remote exploitation over the network is described. Because the flaw is only exploitable with direct hardware interface, the risk remains high for environments where the device could be accessed physically by attackers.