EUVD-2026-34143
GHSA-rv93-ggmg-88r9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability (Access-Control-Allow-Origin: *) to internet-originated attacks.
AnalysisAI
DNS rebinding on the Mercusys AC12G (EU) V1 router (firmware AC12G(EU)_V1_200909) exposes the router's web management interface to attacker-controlled external origins due to absent HTTP Host header validation. A remote unauthenticated attacker (per CVSS PR:N) can rebind a malicious domain to the router's LAN IP address, then leverage the router's pre-existing CORS wildcard (Access-Control-Allow-Origin: *) to read admin interface responses cross-origin from within the victim's browser. No public exploit beyond the researcher's advisory exists and no CISA KEV listing is present at time of analysis.
Technical ContextAI
CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action) describes the root cause: the router's embedded HTTP server does not validate the HTTP Host header against an allowlist of known-good values (LAN IP, hostname), which is the primary browser-enforced defense against DNS rebinding. DNS rebinding works by registering a domain with an extremely short TTL - initially resolving to the attacker's server to serve the malicious page, then immediately repointing DNS to the victim router's private IP (e.g., 192.168.1.1). The victim's browser, already holding a tab on the attacker's domain, reuses the origin context and routes subsequent XHR/fetch calls to the router. The compounding misconfiguration - CORS response header Access-Control-Allow-Origin: * - strips the same-origin policy backstop that would otherwise block the attacker's JavaScript from reading those responses. Affected hardware is specifically the Mercusys AC12G (EU) V1; the NVD CPE string cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* is unresolved, indicating the NVD has not yet formally catalogued precise CPE boundaries for this firmware.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary firmware-level fix would be for Mercusys to add Host header validation to the router's HTTP server, rejecting requests whose Host value does not match the router's configured LAN IP or hostname - users should monitor Mercusys firmware release notes for a corrective update. As an immediate network-level workaround, deploying a DNS resolver with anti-rebinding enforcement (dnsmasq --stop-dns-rebind flag, Pi-hole's DNSSEC/rebind protection, or pfSense/OPNsense DNS rebinding protection) at the LAN perimeter blocks the DNS phase of the attack before the browser can redirect requests; this has negligible trade-offs for home/SOHO networks. Disabling the router's web management interface access from the LAN entirely is not a realistic option for most users but would eliminate the attack surface. Restricting LAN access to the router admin UI to a single management host via firewall ACL reduces the pool of exploitable victims. References: researcher advisory at https://github.com/Tymbark7372/MERCUSYS-AC12G/blob/master/advisories/CVE-2026-36604.md; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-36604.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today