CVE-2026-36618: Mercusys AC12G DNS Version Disclosure Vulnerability

Technical summary

The vulnerability stems from the router's DNS resolver responding to version.bind CHAOS TXT queries, a standard DNS query type that software typically disables or restricts. By sending a DNS query for version.bind in the CHAOS class, an attacker can elicit a response revealing that unbound 1.22.0 is the underlying DNS resolver. This information disclosure falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack vector is adjacent network access with no authentication or user interaction required. The scope remains unchanged (local only), and the impact is limited to confidentiality—an attacker gains useful reconnaissance data but cannot directly modify the router or deny service through this method alone.

Business impact

For most organizations, this vulnerability presents minimal direct business risk because the router is a consumer-grade access point designed for small office or home use. However, if deployed in a small business or branch office as part of the network perimeter, the information leak could facilitate reconnaissance for follow-on attacks. An attacker who learns the DNS resolver version might then attempt to exploit known vulnerabilities in unbound 1.22.0, potentially compromising DNS resolution integrity or availability on that network segment. The real risk emerges in multi-stage attack scenarios where this disclosure is one of several reconnaissance steps.

Affected systems

Only the Mercusys AC12G (EU) model V1 running firmware AC12G(EU)_V1_200909 is confirmed affected. Mercusys is a sister brand of TP-Link, primarily distributed in European markets. Organizations using this specific router model should verify their firmware version. It is unclear from available data whether other Mercusys models, earlier or later firmware versions, or the non-EU AC12G variant exhibit the same behavior—those should be tested independently or checked against vendor advisories.

Exploitability

Exploitation requires an attacker to be on the same network segment or have routing access to the router's management network. The attack itself is trivial: a single DNS query using standard tools (dig, nslookup, or custom scripts) with the correct parameters will trigger the disclosure. No authentication is required, and the query is not resource-intensive. However, practical exploitability is limited because the attacker must first have network proximity to the device, which constrains the threat to insider threats, compromised devices on the same network, or attackers who have already gained initial access to the network. The CVSS score of 4.3 (MEDIUM) reflects this balance: low practical exploitability offset by ease of execution once access is achieved.

Remediation

Firmware updates are the primary remediation. Contact Mercusys support or check the product support page for AC12G (EU) V1 to obtain and apply the latest available firmware. Firmware updates typically include security patches that disable or restrict CHAOS TXT responses. As an interim mitigation, restrict DNS query types at the network perimeter firewall level to block CHAOS queries from untrusted sources, or isolate the router on a separate management network. Disable DNS features on the router if they are not required for the network's function.

Patch guidance

Check the Mercusys official support portal for firmware updates specifically for the AC12G (EU) V1 model. The affected version is AC12G(EU)_V1_200909; verify against the vendor advisory to confirm that newer firmware versions address version.bind query restrictions. Apply firmware updates through the router's web administration interface or via a firmware management tool provided by Mercusys, following their standard procedures to avoid interrupting service or bricking the device. Test in a non-production environment if possible. After patching, re-run DNS reconnaissance tests (dig version.bind @<router-ip> CH TXT) to confirm the information is no longer disclosed.

Detection guidance

Monitor DNS query logs for CHAOS TXT queries targeting version.bind or similar reconnaissance patterns. Use network monitoring tools (Zeek, Suricata, tcpdump) to flag DNS queries with the CHAOS class targeting sensitive queries on internal routers. Implement DNS query logging at the router level if available. Check for suspicious patterns of DNS reconnaissance from client IP addresses on the network. In security operations, this is a low-priority detection task unless correlated with other attack indicators (lateral movement, credential testing, etc.), but it can serve as an early warning of reconnaissance activity.

Why prioritize this

This vulnerability warrants attention but not top-tier priority for most organizations. It is a MEDIUM-severity information disclosure with limited scope (local network only) and moderate exploitability barriers (network proximity required). Prioritization should be higher if: (1) the organization uses this router model in a security-sensitive environment (branch office, DMZ gateway, etc.); (2) the network has a significant insider threat or a history of lateral movement incidents; or (3) the router is exposed to untrusted network segments. For typical business environments, this is a patch-on-cycle item rather than an emergency fix.

Risk score, explained

CVSS 3.1 score of 4.3 reflects a vulnerability with limited but real impact. The Adjacent Network (AV:A) vector acknowledges that an attacker needs to be on or near the network to exploit it. Attack Complexity Low (AC:L) and No Privileges Required (PR:N) show that the actual exploit is trivial once access is gained. Unchanged Scope (S:U) means the compromise is confined to the affected router. Low Confidentiality Impact (C:L) is appropriate because only version information is leaked, not sensitive user data or cryptographic material. No Integrity or Availability impact reflects that this is reconnaissance-only. The score sits at the midpoint of MEDIUM severity, indicating it is a real concern but not critical.

Frequently asked questions