CVE-2026-36604

DNS Rebinding Vulnerability in Mercusys AC12G Router Permits Remote Management Access

View on CVE.org
Published Jun 3, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability (Access-Control-Allow-Origin: *) to internet-originated attacks.

Analysis

AI-generated

Technical impact

The router does not validate the HTTP Host header, allowing DNS rebinding. An attacker can rebind a domain to the router’s internal IP, directing a client such as a web browser to send requests to the management interface from an external origin. The vulnerability directly permits unauthorized access to the administration interface; based on the description, it is inferred that an attacker could alter settings or obtain credentials once they have access to the interface.

Affected Systems

Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk level. EPSS information is not available and the flaw is not listed in the CISA KEV catalog, so the probability of a public exploit is unknown. The likely attack vector is an external DNS rebinding attempt, such as a web browser that can resolve a domain to the router’s internal IP. No special privileges beyond network connectivity and the ability to host a rebinding-capable client are required.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router’s firmware to a version that includes host‑header validation and addresses the DNS rebinding flaw.
  • Configure the router or an upstream firewall to reject HTTP requests that lack proper Host headers or to block external access to the management interface.
  • Restrict the router’s management interface to trusted internal IP ranges or place it on a separate network segment that is not exposed to the public gateway.
  • As a temporary containment measure, apply a DNS rebinding protection service that prevents external domains from reassigning to the router’s internal IP.

Generated by OpenCVE AI on June 4, 2026 at 01:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Mercusys
Mercusys ac12g
Vendors & Products Mercusys
Mercusys ac12g
Type Values Removed Values Added
Title DNS Rebinding Vulnerability in Mercusys AC12G Router Permits Remote Management Access
Type Values Removed Values Added
Title DNS Rebinding Vulnerability in Mercusys AC12G Router V1
Weaknesses CWE-20
Type Values Removed Values Added
Weaknesses CWE-350
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title DNS Rebinding Vulnerability in Mercusys AC12G Router V1
Weaknesses CWE-20
Type Values Removed Values Added
Description Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability (Access-Control-Allow-Origin: *) to internet-originated attacks.
References
Earlier changes (1)
Weaknesses
  • CWE-350

    Reliance on Reverse DNS Resolution for a Security-Critical Action

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jun 3, 2026, 7:41 PM
Reserved
Apr 6, 2026, 12:00 AM

View source JSON

Updated
Jun 3, 2026, 7:40 PM

JSON

Status
Deferred
Published
Jun 3, 2026, 6:16 PM
Modified
Jul 22, 2026, 7:10 PM

View source JSON

No data.

Updated
Jun 5, 2026, 10:12 AM

JSON