The vulnerability exists in the /api/settings/database endpoint of 9router, which accepts HTTP requests without requiring any user authentication besides a generic middleware that only checks for the presence of a JWT or CLI token. Prior to version 0.4.80, this endpoint lets an attacker download an entire database dump containing credentials, API keys, OAuth tokens, and configuration settings, and also upload a new database file that overwrites the existing one. This results in a severe confidentiality breach, an integrity violation, and the possibility of a complete system takeover, represented by CWE‑200.

The product in question is 9router, developed by decolua. All releases older than v0.4.80 are affected. Versions v0.4.80 and later incorporate a fix that removes the unauthenticated export/import capabilities.

The CVSS score of 9.9 classifies the issue as critical, while the EPSS score of less than 1% indicates that statistically the exploitation rate is low. Nevertheless, the attack is straightforward: an unauthenticated HTTP request to the affected endpoint, which an adversary can perform if the service is reachable from their network. The reachability could be internal or external, depending on how the deployment is exposed. Because full read/write access to the database is granted, the threat is effectively a complete compromise of the target system.