Is CVE-2026-36604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-36604 being exploited in the wild.

How severe is CVE-2026-36604?

Informational severity, with a CVSS score of 6.5, published 3 June 2026.

Which products and versions are affected?

Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

Is there a fix for CVE-2026-36604?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-36604 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-36604?

Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-36604: Mercusys AC12G DNS rebinding via missing Host header validation

CVE-2026-36604 · Severity: info · CVSS 6.5 · Published 2026-06-03

The Mercusys AC12G router, a device used to provide home and small office internet connectivity, contains a security flaw in how it handles web traffic. An attacker can trick a user's web browser into communicating with the router's internal management interface by using a malicious website. This could allow an unauthorized person to bypass security boundaries and potentially access or modify router settings if the user visits a compromised site.

Technologies: Mercusys AC12G (EU) V1. Vendors: Mercusys.

Quick answers

Is CVE-2026-36604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-36604 being exploited in the wild.
How severe is CVE-2026-36604?: Informational severity, with a CVSS score of 6.5, published 3 June 2026.
Which products and versions are affected?: Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.
Is there a fix for CVE-2026-36604?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-36604 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-36604?: Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mercusys AC12G (EU) V1 router is vulnerable to DNS rebinding attacks due to two primary failures: the HTTP server does not validate the 'Host' header in incoming requests, and the integrated DNS resolver (Unbound) does not filter private IP addresses from DNS responses. Additionally, the router implements a global CORS wildcard (Access-Control-Allow-Origin: *), which allows malicious JavaScript executed in a victim's browser to read responses from the router's management interface. By tricking a LAN user into visiting a malicious domain with a short TTL, an attacker can rebind that domain to the router's internal IP (e.g., 192.168.1.1). This bypasses the Same-Origin Policy and can be chained with other vulnerabilities to achieve full device compromise. No fix is planned as the device is end-of-life.

Affected products

Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

Timeline

2026-06-03: disclosed: Vulnerability published via NVD and GitHub advisory

References

https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36604.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.