CVE-2026-36618: Mercusys AC12G Information Disclosure Flaw

CVE-2026-36618 Overview

CVE-2026-36618 is an information disclosure vulnerability affecting the Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The device responds to version.bind CHAOS TXT queries sent to its embedded DNS resolver. These queries return the underlying resolver software version, specifically unbound 1.22.0. Attackers on an adjacent network can fingerprint the resolver and map it to known vulnerabilities. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Adjacent network attackers can identify the exact DNS resolver version running on affected Mercusys routers, enabling targeted exploitation of known unbound vulnerabilities.

Affected Products

Mercusys AC12G (EU) V1
Firmware version AC12G(EU)_V1_200909
Embedded unbound 1.22.0 DNS resolver

Discovery Timeline

2026-06-03 - CVE-2026-36618 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-36618

Vulnerability Analysis

The Mercusys AC12G (EU) V1 router exposes a DNS resolver that answers special-purpose CHAOS class queries. When a client on an adjacent network sends a TXT query for version.bind in the CHAOS (CH) class, the resolver returns its software identification string. The response discloses that the device runs unbound 1.22.0.

Version disclosure on its own does not grant code execution or modify data. The risk arises from the precise software identification it provides. Attackers can correlate the disclosed version with public vulnerability databases and select exploits matching that build. This shortens reconnaissance time and increases the probability of a successful follow-on attack.

The issue maps to CWE-200, which covers exposure of sensitive information to actors that should not have access to it.

Root Cause

The embedded unbound resolver ships with its default behavior of answering identification queries in the CHAOS class. The vendor configuration does not disable responses to version.bind, version.server, hostname.bind, or related CHAOS TXT lookups. Disabling these responses requires explicit hide-version: yes and hide-identity: yes directives in unbound.conf, which are absent in the shipped firmware.

Attack Vector

Exploitation requires network adjacency to the router, typically meaning the attacker is on the same local network or Wi-Fi segment. The attacker issues a single DNS query such as dig @<router-ip> version.bind TXT CH and reads the returned string. No authentication, user interaction, or elevated privileges are required. The vulnerability does not affect integrity or availability.

No verified proof-of-concept code is published beyond the GitHub advisory. The technique relies on the documented behavior of standard DNS clients querying the CHAOS class.

Detection Methods for CVE-2026-36618

Indicators of Compromise

DNS queries to internal router IP addresses with QCLASS=CH and QNAME=version.bind, version.server, or hostname.bind
Outbound DNS responses from router interfaces containing the string unbound 1.22.0
Repeated CHAOS class lookups originating from unmanaged or guest-network endpoints

Detection Strategies

Inspect network captures on the LAN segment for DNS packets where the question class is CHAOS (value 3) instead of the typical IN class
Configure intrusion detection systems to alert on TXT queries for version.bind or version.server directed at infrastructure devices
Baseline normal DNS traffic patterns to the router and flag deviations involving non-IN class queries

Monitoring Recommendations

Log all DNS traffic that targets the router management interface and review CHAOS class entries
Correlate reconnaissance scans against routers with subsequent connection attempts to known unbound vulnerability surfaces
Track firmware versions across managed network equipment to identify devices running AC12G(EU)_V1_200909

How to Mitigate CVE-2026-36618

Immediate Actions Required

Restrict access to the router's DNS service so that only trusted internal clients can issue queries
Segment guest and IoT networks from infrastructure management interfaces
Monitor for new firmware releases from Mercusys that address CHAOS class response behavior

Patch Information

No vendor patch is referenced in the advisory at the time of NVD publication. Consult the GitHub advisory for CVE-2026-36618 for updates and confirm any future firmware release from Mercusys before deployment.

Workarounds

Place the router behind a firewall rule that drops external DNS queries to its LAN-facing resolver from untrusted segments
If administrative access to the resolver configuration is available, disable identification responses by enabling hide-version and hide-identity options
Replace the device's DNS service with an upstream resolver that does not expose CHAOS TXT identifiers

bash

# Configuration example: disable version disclosure in unbound
server:
    hide-version: yes
    hide-identity: yes
    # Optionally restrict who can query the resolver
    access-control: 192.168.0.0/16 allow
    access-control: 0.0.0.0/0 refuse