Unauthenticated UPnP Port Mapping on Mercusys Router

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-36603 exploits a critical authentication bypass in Mercusys AC12G routers where 15 of 18 UPnP IGD (Internet Gateway Device) actions are exposed without credentials on port 1900. This includes the dangerous AddPortMapping action, which allows any device on the local network to create arbitrary port forwarding rules, and GetExternalIPAddress, enabling WAN traffic reconnaissance. Since UPnP is enabled by default, affected organizations running this router model face immediate risk of unauthorized port forwarding, lateral movement into internal networks, and potential exfiltration of sensitive data through attacker-controlled tunnel rules. Small businesses, remote offices, and SMBs relying on Mercusys networking equipment are primary targets, as they typically have lower network monitoring maturity.

Casky's 261 mapped skills detect the attack patterns across TA0004 (Privilege Escalation) and TA0006 (Credential Access) by identifying unauthorized UPnP service interactions and port mapping modifications that deviate from baseline configuration. Practitioners using Casky would observe detection findings highlighting anomalous UPnP IGD action calls originating from unexpected LAN sources, unauthenticated SetStatusChangedNotification or AddPortMapping invocations that lack proper authentication headers, and suspicious modifications to the Device Description XML files that govern service exposure. The platform's extended reasoning capability would correlate these signals with network behavior changes—such as new port forwarding rules appearing without admin intervention—surfacing the underlying exploitation technique and enabling rapid remediation through firmware updates or UPnP service disablement.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-36603.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-36603

Casky has 261 skills that investigate the attack patterns behind CVE-2026-36603. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn