CVE-2026-78861
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key.
Risk Assessment
A local attacker could use the known private key to impersonate or decrypt communications, leading to arbitrary code execution and device compromise. This may threaten network integrity and confidentiality.
Recommendation
Update the device firmware if the vendor has released a fix removing the hardcoded key. Otherwise, consider replacing the device with a model not affected by this issue.
Other vulnerabilities in Mercusys AC12 V2
See all- CVE-2026-78862Medium
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB).
- CVE-2026-78860High
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext.
Original NVD description (English source)
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key
Vulnerability data from NVD (NIST) · CISA KEV · EPSS