The flaw lies in the router’s lack of validation for the HTTP Host header. An attacker who can cause a browser to resolve a malicious domain to the router’s internal IP can rebind that domain, effectively sidestepping the router’s cross‑origin resource sharing policy. This exposes the router’s internal management interface and any services it serves to the public internet, putting confidentiality, integrity and availability at risk as the attacker may inject scripts, steal credentials or alter configuration data.

Mercusys AC12G (EU) V1 router with firmware version AC12G(EU)_V1_200909 is affected. No other vendor or product information is available in the CVE record.

The exploit requires only a DNS rebinding capable client, typically a Web browser, and can be performed from any external network source. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploit has yet been observed. Nevertheless, the theoretical impact is significant because it enables an attacker to reach internal interfaces and systems that otherwise reject direct internet access. Without a vendor patch, the security posture remains vulnerable until a host‑header validation fix is applied or an interim defensive measure is deployed.