Which versions of 9Router are affected by CVE-2026-59800?

A critical remote code execution vulnerability in 9Router (versions before 0.4.44) allows unauthenticated attackers to execute arbitrary commands with root privileges (CVSS 9.2), with exploitation…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59800?

Yes, a public proof-of-concept exploit is available for CVE-2026-59800. Prioritise patching immediately. EPSS: 1.4%.

How to fix or mitigate CVE-2026-59800?

Within 24 hours: Identify all 9Router instances running versions 0.4.43 or earlier and implement emergency network access controls restricting access to the vulnerable POST /api/tunnel/tailscale-install endpoint. Within 7 days: Deploy WAF/IPS detection and blocking rules for exploitation attempts; enable comprehensive logging and alerting for all API access. Within 30 days: Monitor vendor communications for patch availability; prepare emergency patching procedures for version 0.4.44 or later upon release; evaluate alternative solutions if patch timeline exceeds organizational risk tolerance.

9Router CVE-2026-59800

Q: What is the CVSS score of CVE-2026-59800?

CVE-2026-59800 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-42073 CRITICAL

OS Command Injection (CWE-78)

2026-07-07 disclosure@vulncheck.com

GHSA-g6g7-pvmx-m74p

Command Injection

9.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network, unauthenticated (PR:N/UI:N) with root-level C/I/A impact, but AC:H because execution requires the non-default sudo condition (root/NOPASSWD/cached timestamp); no scope change so S:U.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 20:01 EUVD

Analysis Generated

Jul 07, 2026 - 19:32 vuln.today

DescriptionCVE.org

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

AnalysisAI

Remote unauthenticated OS command injection in 9Router before 0.4.44 lets attackers run arbitrary commands as root via the POST /api/tunnel/tailscale-install endpoint, which is excluded from the dashboard authorization middleware. The attacker-supplied sudoPassword field is piped to the stdin of a 'sudo -S sh' child process; when sudo does not prompt for a password, sh interprets that value as a shell command. Active exploitation evidence was reported by the Shadowserver Foundation on 2026-07-04; this is not (yet) listed in CISA KEV, and no public exploit code is referenced in the supplied data.

Technical ContextAI

9Router is an open-source tunneling/router management application (decolua/9router) that exposes an HTTP API and dashboard. The flawed route, /api/tunnel/tailscale-install, is intended to install Tailscale by elevating privileges through 'sudo -S sh', reading the sudo password from stdin. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): rather than being consumed solely as a password, the sudoPassword body field flows into the stdin of an interactive shell ('sh'). Compounding this, the route path is not matched by the dashboard middleware matcher, so no authentication or authorization is enforced before the privileged command path is reached. When sudo returns without prompting - because the process already runs as root, NOPASSWD is set in sudoers, or a recent sudo timestamp cache is valid - the string that was meant to be a password is instead read by sh as a command line.

RemediationAI

Upgrade to 9Router 0.4.44 or later - Vendor-released patch: 0.4.44 - per GitHub advisory GHSA-g6g7-pvmx-m74p (https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p) and the VulnCheck advisory (https://www.vulncheck.com/advisories/9router-os-command-injection-via-sudopassword-parameter-in-tailscale-install-endpoint). If immediate patching is not possible, block or restrict network access to the /api/tunnel/tailscale-install endpoint at a reverse proxy or firewall (deny unauthenticated external access to the 9Router API/dashboard port), which prevents remote reach but will also break the Tailscale-install workflow. Reduce the impact of the sudo path by ensuring the 9Router service does not run as root and removing any NOPASSWD sudoers entry it relies on, and shorten or disable the sudo timestamp cache (timestamp_timeout=0) so a cached credential cannot be abused - note this may break other automation that depended on passwordless sudo. Because active exploitation has been observed, also inspect exposed hosts for post-exploitation activity rather than relying on mitigation alone.