CVE-2026-78860
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext.
Risk Assessment
A local attacker could read sensitive data stored in plaintext, such as passwords or keys, and use it to execute arbitrary code. This may lead to full device takeover.
Recommendation
Update the device firmware if the vendor has released a fix that encrypts stored data. Restrict local access to the device.
Other vulnerabilities in Mercusys AC12 V2
See all- CVE-2026-78862Medium
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB).
- CVE-2026-78861High
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key.
Original NVD description (English source)
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext
Vulnerability data from NVD (NIST) · CISA KEV · EPSS