{"id":"CVE-2026-78861","published":"2026-10-05T20:17:27.427","lastModified":"2026-10-06T17:17:26.800","description":"An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-789"],"vendors":[],"products":[],"references":[{"url":"http://ac12.com","tags":[]},{"url":"http://mercusys.com","tags":[]},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/hardcoded-private-key","tags":[]},{"url":"https://threadpoolx.gitbook.io/docs/cve/mercusys-ac12-v2-security-advisory/hardcoded-private-key","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A local attacker can execute arbitrary code on Mercusys AC12 V2 devices using a hardcoded RSA private key, allowing full system compromise.","exploitability":"Exploitation requires local access to the device and leverages a hardcoded 512-bit RSA private key, making it relatively easy to exploit with minimal prerequisites.","blast_radius":"If exploited, this vulnerability could allow attackers to gain complete control over affected devices, potentially leading to network-wide compromise through lateral movement.","remediation":"Upgrade to firmware version 2.590 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","local","embedded"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:58:37.918Z"}}