Vendors / Mercusys Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 3
Exploited now Mercusys records in CISA KEV No Mercusys vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 65
Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.
CVSS 3.1 MEDIUM 6.8· Physical · No auth · No interaction · EPSS 0.00198 · Published 2025-09-26 · No fix listed CWE-200
Priority MEDIUM 56
A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n.
CVSS 4.0 MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00335 · Published 2025-07-20 · No fix listed CWE-640
Priority LOW 39
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI…
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.13329 · Published 2021-01-07 · No fix listed CWE-22
Priority LOW 37
TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01515 · Published 2022-05-10 · No fix listed CWE-787
Priority LOW 37
TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.01515 · Published 2022-05-10 · No fix listed CWE-787
Priority LOW 36
MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0163 · Published 2021-04-29 · No fix listed
Priority LOW 29
Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01111 · Published 2021-04-29 · No fix listed CWE-79
Priority LOW 28
MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01829 · Published 2021-01-07 · No fix listed CWE-22
Priority LOW 26
Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface.
CVSS 4.0 MEDIUM 5.3· Adjacent network · No auth · No interaction · EPSS 0.00251 · Published 2026-07-27 · No fix listed CWE-121
Priority LOW 12
A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n.
CVSS 4.0 LOW 2.3· Adjacent network · No auth · No interaction · EPSS 0.00333 · Published 2025-07-20 · No fix listed CWE-307
Open these records in search → All records by CVSS severity
0 3 6 1 0
THREATIST.IORead the docs