CVE-2026-63732
9router version 0.4.59 contains a critical flaw that lets anyone log in with the default password, bypass local‑only restrictions, and install a malicious plugin that runs arbitrary code on the host. The issue is fixed in 0.4.60.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
9router firmware 0.4.59 and earlier versions.
Real-world impact
An attacker can gain full control of the router’s operating system by logging in with the default password, spoofing the Host header to reach protected routes, and registering a malicious plugin that executes arbitrary code when triggered.
Why this severity
The CVSS score of 9.4 reflects low attack complexity, no user interaction, and the ability to compromise confidentiality, integrity, and availability of the entire host system.
What to do about it
- 011. Upgrade 9router to version 0.4.60 or later.
- 022. Restart the 9router service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 23, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 28, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.