Vulnerability · Published Jul 23, 2026 · Assigned by VulnCheck

CVE-2026-637329router before 0.4.60 Remote Code Execution via default password

Critical 9.9

In plain English

A critical-severity OS command injection in 9router from decolua. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)1.0%top 36.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin (e.g. node -e <payload>) to achieve arbitrary code execution on the host operating system when the plugin's SSE endpoint is triggered.

Affected products (as reported)

Vendor	Product	Versions
decolua	9router	0 – before 0.4.60

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-4922-8r65-fq26) vendor-advisory
VulnCheck Advisory: 9router before 0.4.60 Remote Code Execution via default password third-party-advisory