Executive brief
9Router, a networking and routing tool, contains a critical security flaw in its Tailscale installation component. An unauthenticated attacker can remotely send a specially crafted request to the device to execute arbitrary system commands. This could lead to a complete takeover of the router, allowing attackers to intercept network traffic, access sensitive data, or use the device as a foothold for further attacks.
Technical details
An OS command injection vulnerability exists in 9Router versions prior to 0.4.44 due to improper input validation and missing authorization. The 'POST /api/tunnel/tailscale-install' endpoint is excluded from the dashboard middleware's authorization checks, allowing unauthenticated access. The application takes the 'sudoPassword' field from the request body and pipes it directly into the stdin of a 'sudo -S sh' process. In environments where the process runs as root (such as default Docker configurations) or where NOPASSWD is configured, the shell interprets the 'sudoPassword' value as a command rather than a password. Attackers can exploit this to achieve Remote Code Execution (RCE) with the privileges of the 9Router process. A patch is available in version 0.4.44.
Affected products
- decolua 9router < 0.4.44
Timeline
- 2026-05-29: advisory: Vendor published GHSA advisory
- 2026-07-04: exploited: First exploitation evidence observed by Shadowserver Foundation
- 2026-07-07: disclosed: CVE published to NVD