9Router CVE-2026-59800

Exploitation requires reaching the unauthenticated POST /api/tunnel/tailscale-install endpoint over the network (this specific route is not covered by the dashboard middleware matcher, so no authentication is needed) and supplying a crafted sudoPassword body field. The concrete limiting factor is the sudo state on the host: command execution only occurs when 'sudo -S sh' does NOT prompt for a password - i.e., the 9Router process already runs as root, sudoers has NOPASSWD for it, or a recent sudo timestamp cache is valid. On hardened deployments where sudo genuinely requires an uncached password, the injected value is consumed as a (wrong) password and code execution does not occur, which is the AT:P attack requirement reflected in the CVSS 4.0 vector.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact, and code execution occurs as root. The single mitigating signal is AT:P (attack requirement present): exploitation only yields command execution when sudo does not prompt for a password (root context, NOPASSWD, or cached sudo timestamp), which is why the score is 9.2 rather than a full 10. Real-world urgency is elevated by exploitation evidence observed by the Shadowserver Foundation on 2026-07-04, indicating opportunistic scanning/exploitation against exposed instances. No EPSS score, SSVC decision, or explicit CISA KEV flag was provided in the input, so the exploitation-probability and formal automatable/decision signals are UNKNOWN here; the Shadowserver observation is the strongest exploitation signal available and should be treated as active targeting even though it is not a CISA KEV confirmation.

An attacker scanning the internet for exposed 9Router dashboards sends a single crafted POST to /api/tunnel/tailscale-install with a sudoPassword body value containing shell metacharacters/commands. Because the route bypasses the dashboard authorization middleware and the underlying 'sudo -S sh' does not prompt (the service runs as root or has cached/NOPASSWD sudo), the injected string is executed by sh as root, giving full command execution with no authentication or user interaction. The low complexity and network vector make this trivially scriptable, consistent with the scanning activity Shadowserver reported on 2026-07-04.