CVE-2026-78861

Summary

A local attacker can execute arbitrary code on Mercusys AC12 V2 devices using a hardcoded RSA private key, allowing full system compromise.

Exploitability

Exploitation requires local access to the device and leverages a hardcoded 512-bit RSA private key, making it relatively easy to exploit with minimal prerequisites.

Blast radius

If exploited, this vulnerability could allow attackers to gain complete control over affected devices, potentially leading to network-wide compromise through lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.