Description
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
Published: 2026-07-07
Score: 9.2 Critical
EPSS: 1.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

9Router versions prior to 0.4.44 contain an OS command injection flaw that is triggered by sending an unauthenticated POST request to the /api/tunnel/tailscale-install endpoint. The request body field sudoPassword is written directly to the standard input of a shell invoked by sudo. When sudo does not request a password—because the process runs as root, NOPASSWD is configured, or a recent timestamp cache exists—the string is interpreted as shell code, allowing an attacker to run arbitrary operating‑system commands.

Affected Systems

The affected product is 9Router from decolua, affecting all releases before 0.4.44. No other product variants are mentioned.

Risk and Exploitability

The CVSS score of 9.2 reflects a critical severity. The EPSS score of 1% indicates a low but nonzero probability that the vulnerability will be exploited. The attack vector is inferred to be a network‑level, unauthenticated POST request to the vulnerable endpoint. Once exploited, the attacker gains full command‑execution rights on the host running 9Router.

Generated by OpenCVE AI on July 26, 2026 at 19:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade 9Router to version 0.4.44 or later, where the vulnerable endpoint is patched
  • Add authentication or authorization checks to the /api/tunnel/tailscale-install endpoint so that only privileged users can trigger the operation
  • If an upgrade cannot be performed immediately, remove any NOPASSWD entries from the sudoers file that allow the user running 9Router to execute commands without a password

Generated by OpenCVE AI on July 26, 2026 at 19:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g6g7-pvmx-m74p 9router: Missing Authorization and OS Command Injection
History

Tue, 07 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Decolua
Decolua 9router
Vendors & Products Decolua
Decolua 9router

Tue, 07 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 07 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Description 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
Title 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Decolua 9router
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-07T19:08:07.806Z

Reserved: 2026-07-07T14:39:14.062Z

Link: CVE-2026-59800

cve-icon Vulnrichment

Updated: 2026-07-07T19:07:05.503Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T19:15:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')