CVE-2026-36604 describes a vulnerability in the Mercusys AC12G (EU) V1 router firmware AC12G(EU)_V1_200909 where the device fails to validate the HTTP Host header. This allows DNS rebinding attacks that can exploit the router's CORS configuration, which uses a wildcard Access-Control-Allow-Origin header, potentially enabling attackers to bypass same-origin policies and interact with the router's internal interface from external origins.

An attacker can perform DNS rebinding to make a domain resolve to the router's internal IP address, leveraging the router's permissive CORS policy to conduct unauthorized actions or access sensitive information via the router's web interface. This could lead to unauthorized control or information disclosure through the router's management interface. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the router's management interface from untrusted networks and avoid exposing the router's web interface to the internet. Monitoring vendor communications for updates is recommended.