A recent vulnerability in the 9router firmware 0.4.59 allows a remote, unauthenticated attacker to gain control of the host operating system. The flaw is the result of several chained weaknesses: a hard‑coded default password (123456) that authenticates fresh installations, a bypass of the LOCAL_ONLY network guard through a spoofed Host header, and the unvalidated use of child_process.spawn() when registering MCP plugins. By exploiting these flaws a malicious actor can authenticate, register a malicious plugin, and cause arbitrary code execution when the plugin’s SSE endpoint is triggered. This is a classic command injection (CWE‑78) with full remote code execution potential.

The affected product is 9router from decolua, in the 0.4.59 release. Firmware 0.4.60 and later contain the fix, so only installations running 0.4.59 or earlier are vulnerable.

The CVSS score for this flaw is 9.4, indicating a very high severity. The EPSS shows a very low probability of exploitation (<1%) but a low probability does not prevent an attacker from attempting the exploit. The flaw is not listed in the CISA KEV catalog, meaning no known large‑scale exploitation has been reported yet. The attack path is straightforward: an unauthenticated attacker sends a request with the default credentials, spoofed Host header to reach protected routes, and registers a malicious plugin that triggers arbitrary code execution. The absence of input validation on child_process.spawn() makes the vulnerability a classic command injection, allowing arbitrary commands to run with the privileges of the 9router process.