9router CVE-2026-63732

Exploitation requires that 9router 0.4.59 is network-reachable and still uses the hardcoded default password (123456), which is present on any fresh, unmodified installation; the attacker must send a forged Host header matching the value the LOCAL_ONLY gate expects for localhost to bypass the network restriction; and the MCP plugin-registration feature must be reachable so a plugin with an attacker-controlled command can be added and its SSE endpoint subsequently triggered to execute. Limiting factors: if the operator has changed the default password, bound the service to loopback at the OS/network level (so a spoofed Host header cannot bypass source-address filtering), or disabled MCP plugin registration, the chain breaks. The CVSS PR:L reflects a login step, but because the required credential is a public constant on default installs, that authentication is not a meaningful barrier.

All available signals point to genuine high priority for anyone running the affected version. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H with subsequent-system SC/SI/SA:H, score 9.4) indicates network reach, low complexity, no user interaction, and full compromise that spreads beyond the vulnerable component to the host OS - consistent with the described arbitrary code execution. The vector lists PR:L, but the description states the login uses a hardcoded default password present on every fresh install, which in practice is equivalent to no authentication; this is a notable tension - the 'privilege' required is a publicly known constant, so real-world exploitability is closer to PR:N than the assigned PR:L. No EPSS score, KEV entry, or explicit POC flag was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the risk rests on the clearly documented, low-effort attack chain rather than observed in-the-wild use. The main mitigating factor is deployment footprint: 9router is an obscure product, so exposure is likely limited to a small number of installs rather than being widespread.

An attacker who can reach the 9router HTTP interface logs in using the well-known default password 123456, then sends requests carrying a spoofed Host header to satisfy the LOCAL_ONLY gate and reach internal routes. They register a malicious MCP plugin whose command is something like 'node -e <payload>', and when the plugin's SSE endpoint is triggered the payload is spawned as a child process, giving arbitrary code execution on the host. No public exploit was identified at time of analysis, but the advisory describes each step concretely enough to reproduce.