CVE-2026-78860

Summary

The Mercusys AC12 V2 device stores sensitive information in plaintext, allowing a local attacker to execute arbitrary code. This represents a critical security flaw that can lead to complete system compromise.

Exploitability

Exploitation requires local access to the device with user privileges, making it moderately difficult but not highly complex to achieve.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control over the router, potentially affecting all network traffic and enabling further attacks on the internal network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later to address this plaintext storage vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.