CVE Tools
Track your stack

Mercusys

2 CVEs tracked since 2021. Since Jan 2021, none of them reached CISA KEV.

Mercusys CVEs per month

Jan 2021 to Jan 2021. Point at a month, or focus the strip and use the arrow keys.
Mercusys CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-0120

Products

The products that kept showing up in Mercusys's monthly top three, with their CVEs summed over those months.

  1. Mercury X18G Firmware21 month

Latest CVEs

The 10 most recently published vulnerabilities affecting Mercusys.

  1. CVE-2026-12495Stack-Based Buffer Overflow in the Mercusys MB115-4G—
  2. CVE-2025-56463Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.6.8
  3. CVE-2025-7882Mercusys MW301R Login excessive authentication3.1
  4. CVE-2025-7881Mercusys MW301R Web Interface password recovery2.7
  5. CVE-2022-26988TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function. Local users could get remote code execution.7.8
  6. CVE-2022-26987TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function. Local users could get remote code execution.7.8
  7. CVE-2021-25811MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the devic...7.5
  8. CVE-2021-25810Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.6.1
  9. CVE-2021-23241MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLe...5.3
  10. CVE-2021-23242MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI.5.3

The record

Peak rank
#179 in Jan 2021
Busiest month shown
Jan 2021, 2 CVEs
Months with a KEV entry
0 since Jan 2021
Monthly snapshots
1 since 2021
Mercusys's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store