CVE-2026-36604 affects the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The vulnerability arises because the router does not validate the HTTP Host header, which can be exploited through DNS rebinding attacks. By rebinding a domain to the router's internal IP, an attacker can leverage the router's permissive CORS policy (Access-Control-Allow-Origin: *) to conduct attacks from internet-originated sources. This vulnerability is categorized under CWE-350 (Incorrect Authorization). No official patch or remediation guidance is currently available.

Successful exploitation allows an attacker to bypass same-origin policy protections by rebinding a domain to the router's internal IP address, potentially enabling unauthorized access to internal router resources via CORS. The vulnerability impacts confidentiality (high impact) but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, network administrators should consider restricting DNS responses and monitoring for suspicious DNS rebinding activity. Users should follow any future vendor advisories for updates or patches addressing this issue.