# CVE-2026-36604: Mercusys AC12G DNS rebinding via missing Host header validation

Source: https://junglewise.ai/threats/cve-2026-36604-mercusys-ac12g-dns-rebinding-via-missing-host-header-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-36604 · Severity: info · CVSS 6.5 · Published 2026-06-03

The Mercusys AC12G router, a device used to provide home and small office internet connectivity, contains a security flaw in how it handles web traffic. An attacker can trick a user's web browser into communicating with the router's internal management interface by using a malicious website. This could allow an unauthorized person to bypass security boundaries and potentially access or modify router settings if the user visits a compromised site.

Technologies: [Mercusys AC12G (EU) V1](https://junglewise.ai/threats/technologies/ac12g-eu-v1). Vendors: [Mercusys](https://junglewise.ai/threats/vendors/mercusys).

## Quick answers

**Is CVE-2026-36604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36604 being exploited in the wild.

**How severe is CVE-2026-36604?** Informational severity, with a CVSS score of 6.5, published 3 June 2026.

**Which products and versions are affected?** Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128.

**Is there a fix for CVE-2026-36604?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36604 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36604?** Check whether you run Mercusys AC12G (EU) V1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Mercusys AC12G (EU) V1 router is vulnerable to DNS rebinding attacks due to two primary failures: the HTTP server does not validate the 'Host' header in incoming requests, and the integrated DNS resolver (Unbound) does not filter private IP addresses from DNS responses. Additionally, the router implements a global CORS wildcard (Access-Control-Allow-Origin: *), which allows malicious JavaScript executed in a victim's browser to read responses from the router's management interface. By tricking a LAN user into visiting a malicious domain with a short TTL, an attacker can rebind that domain to the router's internal IP (e.g., 192.168.1.1). This bypasses the Same-Origin Policy and can be chained with other vulnerabilities to achieve full device compromise. No fix is planned as the device is end-of-life.

## Affected products

- Mercusys AC12G (EU) V1 AC12G(EU)_V1_200909, AC12G(EU)_V1_210128

## Timeline

- 2026-06-03: disclosed: Vulnerability published via NVD and GitHub advisory

## References

- [https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36604.md](https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36604.md)

## Related threats

- [Mercusys AC12G information disclosure in DNS resolver](https://junglewise.ai/threats/cve-2026-36618-mercusys-ac12g-information-disclosure-in-dns-resolver)
- [Mercusys AC12G Information Disclosure in HTTP Server](https://junglewise.ai/threats/cve-2026-36613-mercusys-ac12g-information-disclosure-in-http-server)
- [Mercusys AC12G weak WPS lockout and predictable PIN](https://junglewise.ai/threats/cve-2026-36612-mercusys-ac12g-weak-wps-lockout-and-predictable-pin)
- [Mercusys AC12G cleartext transmission of DDNS credentials](https://junglewise.ai/threats/cve-2026-36610-mercusys-ac12g-cleartext-transmission-of-ddns-credentials)
- [Mercusys AC12G brute-force protection bypass in TDDP endpoint](https://junglewise.ai/threats/cve-2026-36607-mercusys-ac12g-brute-force-protection-bypass-in-tddp-endpoint)