PT-2026-45992

Mercusys AC12G EU V1 router with firmware AC12GEU V1 200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability Access-Control-Allow-Origin: to...

EUVD-2026-34143

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability Access-Control-Allow-Origin: to...

CVE-2026-36604

The Mercusys AC12G (EU) V1 router is vulnerable when running firmware version AC12G(EU)_V1_200909 due to a failure to validate the HTTP Host header . This flaw enables DNS rebinding attacks , allowing an external attacker to rebind a domain to the router's internal IP address. Such an attack exte...