Executive brief
The Mercusys AC12G router, a device used to provide home and small office internet connectivity, contains a security flaw in how it handles web traffic. An attacker can trick a user's web browser into communicating with the router's internal management interface by using a malicious website. This could allow an unauthorized person to bypass security boundaries and potentially access or modify router settings if the user visits a compromised site.
Technical details
The Mercusys AC12G (EU) V1 router is vulnerable to DNS rebinding attacks due to two primary failures: the HTTP server does not validate the 'Host' header in incoming requests, and the integrated DNS resolver (Unbound) does not filter private IP addresses from DNS responses. Additionally, the router implements a global CORS wildcard (Access-Control-Allow-Origin: *), which allows malicious JavaScript executed in a victim's browser to read responses from the router's management interface. By tricking a LAN user into visiting a malicious domain with a short TTL, an attacker can rebind that domain to the router's internal IP (e.g., 192.168.1.1). This bypasses the Same-Origin Policy and can be chained with other vulnerabilities to achieve full device compromise. No fix is planned as the device is end-of-life.
Affected products
- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128
Timeline
- 2026-06-03: disclosed: Vulnerability published via NVD and GitHub advisory