Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities by decolua

    CVE-2026-59800 (GCVE-0-2026-59800)

    Vulnerability from nvd – Published: 2026-07-07 18:19 – Updated: 2026-07-07 19:08 X_Open Source X_Known Exploited Vulnerability
    VLAI
    Title
    9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
    Summary
    9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    decolua 9router Affected: 0 , < 0.4.44 (semver)
    Unaffected: 0.4.44 (semver)
    Create a notification for this product.
    Date Public
    2026-05-29 00:00
    Credits
    Vũ Chí Thành (@vcth4nh) Huỳnh Đức Tin (@Ductinn)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59800",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-07T19:07:58.646180Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-07T19:08:07.806Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/9router",
              "product": "9router",
              "repo": "https://github.com/decolua/9router",
              "vendor": "decolua",
              "versions": [
                {
                  "lessThan": "0.4.44",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "0.4.44",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "V\u0169 Ch\u00ed Th\u00e0nh (@vcth4nh)"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Hu\u1ef3nh \u0110\u1ee9c Tin (@Ductinn)"
            }
          ],
          "datePublic": "2026-05-29T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a \u0027sudo -S sh\u0027 child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC)."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-07T18:25:33.084Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "GitHub Security Advisory (GHSA-g6g7-pvmx-m74p)",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/9router-os-command-injection-via-sudopassword-parameter-in-tailscale-install-endpoint"
            }
          ],
          "tags": [
            "x_open-source",
            "x_known-exploited-vulnerability"
          ],
          "title": "9Router \u003c 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-59800",
        "datePublished": "2026-07-07T18:19:17.154Z",
        "dateReserved": "2026-07-07T14:39:14.062Z",
        "dateUpdated": "2026-07-07T19:08:07.806Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10269 (GCVE-0-2026-10269)

    Vulnerability from nvd – Published: 2026-06-01 15:15 – Updated: 2026-06-01 19:26 X_Open Source
    VLAI
    Title
    decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
    Summary
    A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-285 - Improper Authorization
    • CWE-266 - Incorrect Privilege Assignment
    Assigner
    Impacted products
    Vendor Product Version
    decolua 9router Affected: 0.1
    Affected: 0.2
    Affected: 0.3
    Affected: 0.4.0
    Unaffected: 0.4.1
        cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    brad (VulDB User)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10269",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-01T19:26:23.888695Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-01T19:26:34.067Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*"
              ],
              "modules": [
                "HTTP Header Handler"
              ],
              "product": "9router",
              "vendor": "decolua",
              "versions": [
                {
                  "status": "affected",
                  "version": "0.1"
                },
                {
                  "status": "affected",
                  "version": "0.2"
                },
                {
                  "status": "affected",
                  "version": "0.3"
                },
                {
                  "status": "affected",
                  "version": "0.4.0"
                },
                {
                  "status": "unaffected",
                  "version": "0.4.1"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "brad (VulDB User)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
                "version": "4.0"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
                "version": "3.1"
              }
            },
            {
              "cvssV3_0": {
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
                "version": "3.0"
              }
            },
            {
              "cvssV2_0": {
                "baseScore": 6.5,
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
                "version": "2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-266",
                  "description": "Incorrect Privilege Assignment",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-01T15:15:09.660Z",
            "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "shortName": "VulDB"
          },
          "references": [
            {
              "name": "VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization",
              "tags": [
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://vuldb.com/vuln/367548"
            },
            {
              "name": "VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)",
              "tags": [
                "signature",
                "permissions-required"
              ],
              "url": "https://vuldb.com/vuln/367548/cti"
            },
            {
              "name": "CVE-2026-10269 | CVE Analysis and Report",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/cve/CVE-2026-10269"
            },
            {
              "name": "Submit #825188 | decolua 9router \u003e= 0.2.72, \u003c 0.4.1 Origin Validation Error",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/submit/825188"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/decolua/9router/issues/742"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/decolua/9router/releases/tag/v0.4.1"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/decolua/9router/"
            }
          ],
          "tags": [
            "x_open-source"
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-05-31T00:00:00.000Z",
              "value": "Advisory disclosed"
            },
            {
              "lang": "en",
              "time": "2026-05-31T02:00:00.000Z",
              "value": "VulDB entry created"
            },
            {
              "lang": "en",
              "time": "2026-05-31T16:16:18.000Z",
              "value": "VulDB entry last update"
            }
          ],
          "title": "decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "assignerShortName": "VulDB",
        "cveId": "CVE-2026-10269",
        "datePublished": "2026-06-01T15:15:09.660Z",
        "dateReserved": "2026-05-31T14:09:33.434Z",
        "dateUpdated": "2026-06-01T19:26:34.067Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-5842 (GCVE-0-2026-5842)

    Vulnerability from nvd – Published: 2026-04-09 04:30 – Updated: 2026-04-13 19:59
    VLAI
    Title
    decolua 9router Administrative API Endpoint api authorization
    Summary
    A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    Impacted products
    Vendor Product Version
    decolua 9router Affected: 0.3.0
    Affected: 0.3.1
    Affected: 0.3.2
    Affected: 0.3.3
    Affected: 0.3.4
    Affected: 0.3.5
    Affected: 0.3.6
    Affected: 0.3.7
    Affected: 0.3.8
    Affected: 0.3.9
    Affected: 0.3.10
    Affected: 0.3.11
    Affected: 0.3.12
    Affected: 0.3.13
    Affected: 0.3.14
    Affected: 0.3.15
    Affected: 0.3.16
    Affected: 0.3.17
    Affected: 0.3.18
    Affected: 0.3.19
    Affected: 0.3.20
    Affected: 0.3.21
    Affected: 0.3.22
    Affected: 0.3.23
    Affected: 0.3.24
    Affected: 0.3.25
    Affected: 0.3.26
    Affected: 0.3.27
    Affected: 0.3.28
    Affected: 0.3.29
    Affected: 0.3.30
    Affected: 0.3.31
    Affected: 0.3.32
    Affected: 0.3.33
    Affected: 0.3.34
    Affected: 0.3.35
    Affected: 0.3.36
    Affected: 0.3.37
    Affected: 0.3.38
    Affected: 0.3.39
    Affected: 0.3.40
    Affected: 0.3.41
    Affected: 0.3.42
    Affected: 0.3.43
    Affected: 0.3.44
    Affected: 0.3.45
    Affected: 0.3.46
    Affected: 0.3.47
    Unaffected: 0.3.75
    Create a notification for this product.
    Credits
    cyberthoth (VulDB User)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-5842",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-13T19:59:13.122414Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-13T19:59:23.935Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "modules": [
                "Administrative API Endpoint"
              ],
              "product": "9router",
              "vendor": "decolua",
              "versions": [
                {
                  "status": "affected",
                  "version": "0.3.0"
                },
                {
                  "status": "affected",
                  "version": "0.3.1"
                },
                {
                  "status": "affected",
                  "version": "0.3.2"
                },
                {
                  "status": "affected",
                  "version": "0.3.3"
                },
                {
                  "status": "affected",
                  "version": "0.3.4"
                },
                {
                  "status": "affected",
                  "version": "0.3.5"
                },
                {
                  "status": "affected",
                  "version": "0.3.6"
                },
                {
                  "status": "affected",
                  "version": "0.3.7"
                },
                {
                  "status": "affected",
                  "version": "0.3.8"
                },
                {
                  "status": "affected",
                  "version": "0.3.9"
                },
                {
                  "status": "affected",
                  "version": "0.3.10"
                },
                {
                  "status": "affected",
                  "version": "0.3.11"
                },
                {
                  "status": "affected",
                  "version": "0.3.12"
                },
                {
                  "status": "affected",
                  "version": "0.3.13"
                },
                {
                  "status": "affected",
                  "version": "0.3.14"
                },
                {
                  "status": "affected",
                  "version": "0.3.15"
                },
                {
                  "status": "affected",
                  "version": "0.3.16"
                },
                {
                  "status": "affected",
                  "version": "0.3.17"
                },
                {
                  "status": "affected",
                  "version": "0.3.18"
                },
                {
                  "status": "affected",
                  "version": "0.3.19"
                },
                {
                  "status": "affected",
                  "version": "0.3.20"
                },
                {
                  "status": "affected",
                  "version": "0.3.21"
                },
                {
                  "status": "affected",
                  "version": "0.3.22"
                },
                {
                  "status": "affected",
                  "version": "0.3.23"
                },
                {
                  "status": "affected",
                  "version": "0.3.24"
                },
                {
                  "status": "affected",
                  "version": "0.3.25"
                },
                {
                  "status": "affected",
                  "version": "0.3.26"
                },
                {
                  "status": "affected",
                  "version": "0.3.27"
                },
                {
                  "status": "affected",
                  "version": "0.3.28"
                },
                {
                  "status": "affected",
                  "version": "0.3.29"
                },
                {
                  "status": "affected",
                  "version": "0.3.30"
                },
                {
                  "status": "affected",
                  "version": "0.3.31"
                },
                {
                  "status": "affected",
                  "version": "0.3.32"
                },
                {
                  "status": "affected",
                  "version": "0.3.33"
                },
                {
                  "status": "affected",
                  "version": "0.3.34"
                },
                {
                  "status": "affected",
                  "version": "0.3.35"
                },
                {
                  "status": "affected",
                  "version": "0.3.36"
                },
                {
                  "status": "affected",
                  "version": "0.3.37"
                },
                {
                  "status": "affected",
                  "version": "0.3.38"
                },
                {
                  "status": "affected",
                  "version": "0.3.39"
                },
                {
                  "status": "affected",
                  "version": "0.3.40"
                },
                {
                  "status": "affected",
                  "version": "0.3.41"
                },
                {
                  "status": "affected",
                  "version": "0.3.42"
                },
                {
                  "status": "affected",
                  "version": "0.3.43"
                },
                {
                  "status": "affected",
                  "version": "0.3.44"
                },
                {
                  "status": "affected",
                  "version": "0.3.45"
                },
                {
                  "status": "affected",
                  "version": "0.3.46"
                },
                {
                  "status": "affected",
                  "version": "0.3.47"
                },
                {
                  "status": "unaffected",
                  "version": "0.3.75"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "cyberthoth (VulDB User)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
                "version": "4.0"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
                "version": "3.1"
              }
            },
            {
              "cvssV3_0": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
                "version": "3.0"
              }
            },
            {
              "cvssV2_0": {
                "baseScore": 7.5,
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
                "version": "2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "Authorization Bypass",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-09T04:30:17.225Z",
            "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "shortName": "VulDB"
          },
          "references": [
            {
              "name": "VDB-356298 | decolua 9router Administrative API Endpoint api authorization",
              "tags": [
                "vdb-entry"
              ],
              "url": "https://vuldb.com/vuln/356298"
            },
            {
              "name": "VDB-356298 | CTI Indicators (IOB, IOC, IOA)",
              "tags": [
                "signature",
                "permissions-required"
              ],
              "url": "https://vuldb.com/vuln/356298/cti"
            },
            {
              "name": "Submit #790003 | 9Router Router 0.3.47-0.3.32 Authorization Bypass",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/submit/790003"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/decolua/9router/issues/431"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/decolua/9router/issues/431#issuecomment-4140163867"
            },
            {
              "tags": [
                "exploit"
              ],
              "url": "https://github.com/deepcat1337/Free_Api_Exploit/tree/main"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/decolua/9router/releases/tag/v0.3.75"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/decolua/9router/"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-04-08T00:00:00.000Z",
              "value": "Advisory disclosed"
            },
            {
              "lang": "en",
              "time": "2026-04-08T02:00:00.000Z",
              "value": "VulDB entry created"
            },
            {
              "lang": "en",
              "time": "2026-04-08T19:48:54.000Z",
              "value": "VulDB entry last update"
            }
          ],
          "title": "decolua 9router Administrative API Endpoint api authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "assignerShortName": "VulDB",
        "cveId": "CVE-2026-5842",
        "datePublished": "2026-04-09T04:30:17.225Z",
        "dateReserved": "2026-04-08T17:43:46.180Z",
        "dateUpdated": "2026-04-13T19:59:23.935Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59800 (GCVE-0-2026-59800)

    Vulnerability from cvelistv5 – Published: 2026-07-07 18:19 – Updated: 2026-07-07 19:08 X_Open Source X_Known Exploited Vulnerability
    VLAI
    Title
    9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
    Summary
    9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    decolua 9router Affected: 0 , < 0.4.44 (semver)
    Unaffected: 0.4.44 (semver)
    Create a notification for this product.
    Date Public
    2026-05-29 00:00
    Credits
    Vũ Chí Thành (@vcth4nh) Huỳnh Đức Tin (@Ductinn)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59800",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-07T19:07:58.646180Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-07T19:08:07.806Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/9router",
              "product": "9router",
              "repo": "https://github.com/decolua/9router",
              "vendor": "decolua",
              "versions": [
                {
                  "lessThan": "0.4.44",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "0.4.44",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "V\u0169 Ch\u00ed Th\u00e0nh (@vcth4nh)"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Hu\u1ef3nh \u0110\u1ee9c Tin (@Ductinn)"
            }
          ],
          "datePublic": "2026-05-29T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a \u0027sudo -S sh\u0027 child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC)."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-07T18:25:33.084Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "GitHub Security Advisory (GHSA-g6g7-pvmx-m74p)",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
            },
            {
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/9router-os-command-injection-via-sudopassword-parameter-in-tailscale-install-endpoint"
            }
          ],
          "tags": [
            "x_open-source",
            "x_known-exploited-vulnerability"
          ],
          "title": "9Router \u003c 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-59800",
        "datePublished": "2026-07-07T18:19:17.154Z",
        "dateReserved": "2026-07-07T14:39:14.062Z",
        "dateUpdated": "2026-07-07T19:08:07.806Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10269 (GCVE-0-2026-10269)

    Vulnerability from cvelistv5 – Published: 2026-06-01 15:15 – Updated: 2026-06-01 19:26 X_Open Source
    VLAI
    Title
    decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
    Summary
    A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-285 - Improper Authorization
    • CWE-266 - Incorrect Privilege Assignment
    Assigner
    Impacted products
    Vendor Product Version
    decolua 9router Affected: 0.1
    Affected: 0.2
    Affected: 0.3
    Affected: 0.4.0
    Unaffected: 0.4.1
        cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    brad (VulDB User)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10269",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-01T19:26:23.888695Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-01T19:26:34.067Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:h:decolua:9router:*:*:*:*:*:*:*:*"
              ],
              "modules": [
                "HTTP Header Handler"
              ],
              "product": "9router",
              "vendor": "decolua",
              "versions": [
                {
                  "status": "affected",
                  "version": "0.1"
                },
                {
                  "status": "affected",
                  "version": "0.2"
                },
                {
                  "status": "affected",
                  "version": "0.3"
                },
                {
                  "status": "affected",
                  "version": "0.4.0"
                },
                {
                  "status": "unaffected",
                  "version": "0.4.1"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "brad (VulDB User)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
                "version": "4.0"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
                "version": "3.1"
              }
            },
            {
              "cvssV3_0": {
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
                "version": "3.0"
              }
            },
            {
              "cvssV2_0": {
                "baseScore": 6.5,
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
                "version": "2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-266",
                  "description": "Incorrect Privilege Assignment",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-01T15:15:09.660Z",
            "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "shortName": "VulDB"
          },
          "references": [
            {
              "name": "VDB-367548 | decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization",
              "tags": [
                "vdb-entry",
                "technical-description"
              ],
              "url": "https://vuldb.com/vuln/367548"
            },
            {
              "name": "VDB-367548 | CTI Indicators (IOB, IOC, TTP, IOA)",
              "tags": [
                "signature",
                "permissions-required"
              ],
              "url": "https://vuldb.com/vuln/367548/cti"
            },
            {
              "name": "CVE-2026-10269 | CVE Analysis and Report",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/cve/CVE-2026-10269"
            },
            {
              "name": "Submit #825188 | decolua 9router \u003e= 0.2.72, \u003c 0.4.1 Origin Validation Error",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/submit/825188"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/decolua/9router/issues/742"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/decolua/9router/releases/tag/v0.4.1"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/decolua/9router/"
            }
          ],
          "tags": [
            "x_open-source"
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-05-31T00:00:00.000Z",
              "value": "Advisory disclosed"
            },
            {
              "lang": "en",
              "time": "2026-05-31T02:00:00.000Z",
              "value": "VulDB entry created"
            },
            {
              "lang": "en",
              "time": "2026-05-31T16:16:18.000Z",
              "value": "VulDB entry last update"
            }
          ],
          "title": "decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "assignerShortName": "VulDB",
        "cveId": "CVE-2026-10269",
        "datePublished": "2026-06-01T15:15:09.660Z",
        "dateReserved": "2026-05-31T14:09:33.434Z",
        "dateUpdated": "2026-06-01T19:26:34.067Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-5842 (GCVE-0-2026-5842)

    Vulnerability from cvelistv5 – Published: 2026-04-09 04:30 – Updated: 2026-04-13 19:59
    VLAI
    Title
    decolua 9router Administrative API Endpoint api authorization
    Summary
    A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    Impacted products
    Vendor Product Version
    decolua 9router Affected: 0.3.0
    Affected: 0.3.1
    Affected: 0.3.2
    Affected: 0.3.3
    Affected: 0.3.4
    Affected: 0.3.5
    Affected: 0.3.6
    Affected: 0.3.7
    Affected: 0.3.8
    Affected: 0.3.9
    Affected: 0.3.10
    Affected: 0.3.11
    Affected: 0.3.12
    Affected: 0.3.13
    Affected: 0.3.14
    Affected: 0.3.15
    Affected: 0.3.16
    Affected: 0.3.17
    Affected: 0.3.18
    Affected: 0.3.19
    Affected: 0.3.20
    Affected: 0.3.21
    Affected: 0.3.22
    Affected: 0.3.23
    Affected: 0.3.24
    Affected: 0.3.25
    Affected: 0.3.26
    Affected: 0.3.27
    Affected: 0.3.28
    Affected: 0.3.29
    Affected: 0.3.30
    Affected: 0.3.31
    Affected: 0.3.32
    Affected: 0.3.33
    Affected: 0.3.34
    Affected: 0.3.35
    Affected: 0.3.36
    Affected: 0.3.37
    Affected: 0.3.38
    Affected: 0.3.39
    Affected: 0.3.40
    Affected: 0.3.41
    Affected: 0.3.42
    Affected: 0.3.43
    Affected: 0.3.44
    Affected: 0.3.45
    Affected: 0.3.46
    Affected: 0.3.47
    Unaffected: 0.3.75
    Create a notification for this product.
    Credits
    cyberthoth (VulDB User)
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-5842",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-04-13T19:59:13.122414Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-04-13T19:59:23.935Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "modules": [
                "Administrative API Endpoint"
              ],
              "product": "9router",
              "vendor": "decolua",
              "versions": [
                {
                  "status": "affected",
                  "version": "0.3.0"
                },
                {
                  "status": "affected",
                  "version": "0.3.1"
                },
                {
                  "status": "affected",
                  "version": "0.3.2"
                },
                {
                  "status": "affected",
                  "version": "0.3.3"
                },
                {
                  "status": "affected",
                  "version": "0.3.4"
                },
                {
                  "status": "affected",
                  "version": "0.3.5"
                },
                {
                  "status": "affected",
                  "version": "0.3.6"
                },
                {
                  "status": "affected",
                  "version": "0.3.7"
                },
                {
                  "status": "affected",
                  "version": "0.3.8"
                },
                {
                  "status": "affected",
                  "version": "0.3.9"
                },
                {
                  "status": "affected",
                  "version": "0.3.10"
                },
                {
                  "status": "affected",
                  "version": "0.3.11"
                },
                {
                  "status": "affected",
                  "version": "0.3.12"
                },
                {
                  "status": "affected",
                  "version": "0.3.13"
                },
                {
                  "status": "affected",
                  "version": "0.3.14"
                },
                {
                  "status": "affected",
                  "version": "0.3.15"
                },
                {
                  "status": "affected",
                  "version": "0.3.16"
                },
                {
                  "status": "affected",
                  "version": "0.3.17"
                },
                {
                  "status": "affected",
                  "version": "0.3.18"
                },
                {
                  "status": "affected",
                  "version": "0.3.19"
                },
                {
                  "status": "affected",
                  "version": "0.3.20"
                },
                {
                  "status": "affected",
                  "version": "0.3.21"
                },
                {
                  "status": "affected",
                  "version": "0.3.22"
                },
                {
                  "status": "affected",
                  "version": "0.3.23"
                },
                {
                  "status": "affected",
                  "version": "0.3.24"
                },
                {
                  "status": "affected",
                  "version": "0.3.25"
                },
                {
                  "status": "affected",
                  "version": "0.3.26"
                },
                {
                  "status": "affected",
                  "version": "0.3.27"
                },
                {
                  "status": "affected",
                  "version": "0.3.28"
                },
                {
                  "status": "affected",
                  "version": "0.3.29"
                },
                {
                  "status": "affected",
                  "version": "0.3.30"
                },
                {
                  "status": "affected",
                  "version": "0.3.31"
                },
                {
                  "status": "affected",
                  "version": "0.3.32"
                },
                {
                  "status": "affected",
                  "version": "0.3.33"
                },
                {
                  "status": "affected",
                  "version": "0.3.34"
                },
                {
                  "status": "affected",
                  "version": "0.3.35"
                },
                {
                  "status": "affected",
                  "version": "0.3.36"
                },
                {
                  "status": "affected",
                  "version": "0.3.37"
                },
                {
                  "status": "affected",
                  "version": "0.3.38"
                },
                {
                  "status": "affected",
                  "version": "0.3.39"
                },
                {
                  "status": "affected",
                  "version": "0.3.40"
                },
                {
                  "status": "affected",
                  "version": "0.3.41"
                },
                {
                  "status": "affected",
                  "version": "0.3.42"
                },
                {
                  "status": "affected",
                  "version": "0.3.43"
                },
                {
                  "status": "affected",
                  "version": "0.3.44"
                },
                {
                  "status": "affected",
                  "version": "0.3.45"
                },
                {
                  "status": "affected",
                  "version": "0.3.46"
                },
                {
                  "status": "affected",
                  "version": "0.3.47"
                },
                {
                  "status": "unaffected",
                  "version": "0.3.75"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "cyberthoth (VulDB User)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
                "version": "4.0"
              }
            },
            {
              "cvssV3_1": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
                "version": "3.1"
              }
            },
            {
              "cvssV3_0": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
                "version": "3.0"
              }
            },
            {
              "cvssV2_0": {
                "baseScore": 7.5,
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
                "version": "2.0"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "Authorization Bypass",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-09T04:30:17.225Z",
            "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "shortName": "VulDB"
          },
          "references": [
            {
              "name": "VDB-356298 | decolua 9router Administrative API Endpoint api authorization",
              "tags": [
                "vdb-entry"
              ],
              "url": "https://vuldb.com/vuln/356298"
            },
            {
              "name": "VDB-356298 | CTI Indicators (IOB, IOC, IOA)",
              "tags": [
                "signature",
                "permissions-required"
              ],
              "url": "https://vuldb.com/vuln/356298/cti"
            },
            {
              "name": "Submit #790003 | 9Router Router 0.3.47-0.3.32 Authorization Bypass",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://vuldb.com/submit/790003"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/decolua/9router/issues/431"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/decolua/9router/issues/431#issuecomment-4140163867"
            },
            {
              "tags": [
                "exploit"
              ],
              "url": "https://github.com/deepcat1337/Free_Api_Exploit/tree/main"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/decolua/9router/releases/tag/v0.3.75"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/decolua/9router/"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-04-08T00:00:00.000Z",
              "value": "Advisory disclosed"
            },
            {
              "lang": "en",
              "time": "2026-04-08T02:00:00.000Z",
              "value": "VulDB entry created"
            },
            {
              "lang": "en",
              "time": "2026-04-08T19:48:54.000Z",
              "value": "VulDB entry last update"
            }
          ],
          "title": "decolua 9router Administrative API Endpoint api authorization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "assignerShortName": "VulDB",
        "cveId": "CVE-2026-5842",
        "datePublished": "2026-04-09T04:30:17.225Z",
        "dateReserved": "2026-04-08T17:43:46.180Z",
        "dateUpdated": "2026-04-13T19:59:23.935Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }