CVE-2026-36604
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
This router doesn't check where requests come from, allowing attackers to trick your browser into sending commands to your router from a malicious website. The router's overly permissive security settings make this possible.
The Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 fails to validate HTTP Host headers, enabling DNS rebinding attacks. Combined with CORS misconfiguration (Access-Control-Allow-Origin: *), an external attacker can exploit this via cross-origin requests from a malicious domain that resolves to the router's internal IP, potentially leading to unauthorized configuration changes or information disclosure.