An unauthorized API call in decolua 9router up to version 0.3.47 permits a malicious actor to bypass authentication controls and obtain administrative privileges without supplying valid credentials. The flaw originates from an improper authorization check in a component of the /api administrative endpoint. The vulnerability can be exploited remotely by sending specially crafted HTTP requests, potentially enabling attackers to modify router configuration, access confidential data, or disrupt network services.

The vulnerable entries affect decolua 9router router firmware, specifically the Administrative API Endpoint component. Any appliance running firmware version 0.3.47 or earlier is susceptible. Firmware upgrade to version 0.3.75 or later removes the flaw, making the device secure against this bypass.

The CVSS base score of 6.9 reflects moderate severity, yet the scenario is realistic and convenient for attackers. No EPSS data is available, and the issue is not in CISA KEV, but publicly available exploit code confirms that remote exploitation can be achieved quickly. Because the attack can be performed from outside the local network by targeting the exposed API endpoint, the risk to organizations remains high until the firmware is updated or the endpoint is isolated with network controls.