9router Critical Vulnerability Chain Allows Remote Code Execution via Default Password and Plugin Exploitation

A critical vulnerability chain, identified as CVE-2026-63732, affects 9router version 0.4.59. This chain enables a remote, unauthenticated attacker to gain arbitrary code execution on the underlying host operating system. The attack begins with exploitation of a hardcoded default password, '123456', which provides initial authentication to any fresh installation of the software. Following authentication, the attacker can bypass a network gate designed to restrict access to 'LOCAL_ONLY' routes by spoofing the Host header in HTTP requests. The final stage involves registering a malicious MCP plugin, leveraging unvalidated arguments passed to child_process.spawn(). This allows the attacker to embed and execute arbitrary commands, such as node -e <payload>, on the server when the plugin's Server-Sent Events (SSE) endpoint is subsequently triggered. This vulnerability chain poses a severe risk to organizations using affected 9router instances, as it permits full system compromise without prior authentication.

Attack Chain

1. A remote, unauthenticated attacker identifies a vulnerable 9router instance (version 0.4.59) exposed to the internet.
2. The attacker gains initial access to the 9router web interface by authenticating with the hardcoded default password, "123456".
3. The attacker crafts an HTTP request to a route intended for local access only, spoofing the Host header to bypass the LOCAL_ONLY network gate.
4. Utilizing the authenticated session and bypass, the attacker proceeds to register a malicious MCP plugin.
5. During plugin registration, the attacker injects unvalidated arguments into the application's call to child_process.spawn().
6. The injected arguments include a command payload, such as node -e <arbitrary_command>, intended for execution on the host operating system.
7. The attacker triggers the newly registered plugin's Server-Sent Events (SSE) endpoint, causing the 9router application to execute the malicious command.
8. Successful execution of the injected command leads to arbitrary code execution (RCE) on the host operating system where 9router is running.

Impact

Successful exploitation of CVE-2026-63732 results in complete compromise of the underlying operating system hosting the 9router application. A remote, unauthenticated attacker can execute arbitrary commands, leading to full system control, data exfiltration, deployment of additional malware (e.g., ransomware, backdoors), or disruption of services. Given the critical severity (CVSS 9.9), the impact on affected organizations could be catastrophic, potentially leading to significant financial losses, reputational damage, and operational downtime. The NVD does not specify observed victim count or targeted sectors, but any organization using 9router 0.4.59 is at risk.

Recommendation

• Immediately upgrade all 9router instances to version 0.4.60 or later to patch CVE-2026-63732.
• Change the default password "123456" on any 9router installations, especially on versions prior to 0.4.60.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious node command executions.
• Enable comprehensive logging for process creation events on servers running 9router, specifically for the product: windows and product: linux logsources, to activate the provided Sigma rules.