Mercusys vulnerabilities

10 vulnerabilities

Known vulnerabilities in Mercusys products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

5
6.1MediumCVE-2021-25810mercusys · mercury_x18g_firmwaremercusys mercury_x18g_firmwareCross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.EPSS1.11%7.8HighCVE-2021-25811mercusys · mercury_x18g_firmwaremercusys mercury_x18g_firmwareMERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed.EPSS1.63%5.3MediumCVE-2021-23241mercusys · mercury_x18g_firmwaremercusys mercury_x18g_firmwareMERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.EPSS13.33%5.3MediumCVE-2021-23242mercusys · mercury_x18g_firmwaremercusys mercury_x18g_firmwareMERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI.EPSS1.83%3.1LowCVE-2025-7882mercusys · mw301rMercusys MW301R Login excessive authenticationA vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the component Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.EPSS0.33%5.1MediumCVE-2025-7881mercusys · mw301rMercusys MW301R Web Interface password recoveryA vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument code leads to weak password recovery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.EPSS0.34%6.8MediumCVE-2025-56463mercusys · mw305r_firmwaremercusys mw305r_firmwareMercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.EPSS0.20%7.8HighCVE-2022-26987fastcom · fac1900r_firmware +5 morefastcom fac1900r_firmwareTP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function. Local users could get remote code execution.EPSS1.52%7.8HighCVE-2022-26988fastcom · fac1900r_firmware +5 morefastcom fac1900r_firmwareTP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function. Local users could get remote code execution.EPSS1.52%5.3MediumCVE-2026-12495mercusys · mb115-4gStack-Based Buffer Overflow in the Mercusys MB115-4GDenial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory corruption and the httpd process to crash, resulting in a denial of service for the web administration service.EPSS0.25%