Skip to content
Threat Feed
Subscribe

Product

9router 0.4.59

1 brief RSS
critical advisory

9router Critical Vulnerability Chain Allows Remote Code Execution via Default Password and Plugin Exploitation

A critical vulnerability chain, CVE-2026-63732, in 9router version 0.4.59 allows a remote, unauthenticated attacker to achieve arbitrary code execution on the host operating system by leveraging a hardcoded default password for initial access, bypassing a local-only network restriction via Host header spoofing, and exploiting unvalidated arguments during MCP plugin registration to execute malicious code when a plugin's SSE endpoint is triggered.

9router 0.4.59 vulnerability remote-code-execution hardcoded-credentials webserver nodejs
2r 3t 1c 1i