decolua 9router EUVD-2026-33685

Exploitation requires network-level reachability to the 9router HTTP service port on a host running version 0.4.0 or earlier. The attacker must supply a Host header value of localhost, 127.0.0.1, or ::1 in the HTTP request - no other special configuration or feature flag is required for the bypass to trigger. The CVSS PR:L rating indicates low privileges are required; however, the mechanism of the bypass is to circumvent authentication, so teams should verify with the vendor or by testing whether any credential is actually needed before the Host-spoofed request is accepted - this inconsistency is not fully resolved by the available data. Exploitation is limited to 9router instances reachable from untrusted networks; instances whose HTTP port is exclusively bound to loopback (127.0.0.1) without any reverse proxy forwarding external traffic are not exploitable from remote. No non-default application configuration is required.

The CVSS 6.3 Medium score reflects network reachability (AV:N), low complexity (AC:L), low required privileges (PR:L), no user interaction (UI:N), and limited per-component impact (C:L/I:L/A:L with unchanged scope). The PR:L rating warrants scrutiny: the primary bypass mechanism circumvents JWT authentication, yet the scorer assigned low rather than no privileges - teams should verify with the vendor whether any credential is truly required prior to sending the Host-spoofed request or whether PR:L reflects the scorer's conservative judgment. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified. The CVE is not in CISA KEV, and no public exploit code has been identified, reducing immediate urgency. However, the Host header spoofing technique is elementary - requiring only standard HTTP tooling - meaning attack complexity is effectively trivial once a reachable instance is found. Real-world risk is moderate: impact is bounded to the 9router application scope (S:U), with no lateral privilege escalation indicated. Instances exposed to untrusted networks should prioritize patching above what the CVSS alone suggests due to the low-skill exploitation technique.

An attacker with network access to a 9router instance sends an HTTP request to a protected endpoint such as one listed in PROTECTED_API_PATHS, including the header Host: localhost in the request. The vulnerable isLocalRequest() function evaluates this header, returns true, and the isAuthenticated() function skips JWT validation, granting the attacker access to sensitive dashboard or administrative API functionality without valid credentials. No public exploit code has been identified, but the technique requires only curl or equivalent standard HTTP tooling.