PT-2026-45992 · Mercusys · Ac12G

Tymbark7372 · CVE-2026-36604 · Published 2026-06-03 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mercusys AC12G (EU) V1 version AC12G(EU) V1 200909

Description The device fails to validate the HTTP Host header, which allows for DNS rebinding attacks. This occurs when an attacker rebinds a domain to the internal IP address of the router, leveraging a CORS wildcard vulnerability where the Access-Control-Allow-Origin header is set to *. This combination enables attacks originating from the internet to bypass security restrictions. CORS (Cross-Origin Resource Sharing) is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-350

Related Identifiers

CVE-2026-36604

Affected Products

Ac12G

References · 3

• 🔥 https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36604.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36604 · Security Note
• https://t.me/cveNotify/165877 · Telegram Post