{"vulnerability": "CVE-2026-5667", "sightings": [{"uuid": "52f9fba0-7803-4aac-a376-a87fac405cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "seen", "source": "https://t.me/CyberDispatch/2026", "content": "CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance.", "creation_timestamp": "2026-08-30T00:00:39.523607Z"}, {"uuid": "bbd41c4f-aed2-4d95-8ed8-c2527d9624f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56672", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o675pfx2b", "content": "\ud83d\udfe0 CVE-2026-56672 - High (8.2)\n\nComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{fi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56672/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T19:00:19.270250Z"}, {"uuid": "1e598962-84d3-4f92-98ba-b60414ce7477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56673", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4o6frjq32t", "content": "\ud83d\udfe0 CVE-2026-56673 - High (7.5)\n\nComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56673/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T19:00:25.750814Z"}, {"uuid": "e6ad4c90-0874-4635-848d-7a655e7e51ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3molgkjvhag2n", "content": "CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance", "creation_timestamp": "2026-06-18T18:13:12.086426Z"}, {"uuid": "edd34ac2-bf5e-4761-b014-3bb945ac5f07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3moliuhtdar2v", "content": "CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance", "creation_timestamp": "2026-06-18T18:54:32.661579Z"}, {"uuid": "5ed60cdb-a8a1-4303-bb95-d77417ab257e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56677", "type": "published-proof-of-concept", "source": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx", "content": "", "creation_timestamp": "2026-08-17T22:35:10.311901Z"}, {"uuid": "70fe7ff5-025a-4192-b8e5-b19efae686ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56677", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtcso2hlat27", "content": "\ud83d\udfe0 CVE-2026-56677 - High (8.6)\n\n9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoin...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56677/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-17T23:01:55.891077Z"}, {"uuid": "36cf1578-d1ff-4cb3-a02f-bcc71d331c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56677", "type": "seen", "source": "https://gist.github.com/alon710/2e62558f8ce5c6b39d8a9a9db22fa826", "content": "# CVE-2026-56677: CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56677\n\n## Summary\nA high-severity security vulnerability exists in 9Router, an AI router and token saver dashboard. When dashboard authentication features are disabled or left in default configurations, the application exposes administrative testing routines directly to the public internet. Unauthenticated network adversaries can exploit the OIDC configuration validation endpoint to initiate arbitrary HTTP requests, routing unauthorized traffic to local loops, adjacent container ports, and cloud resource metadata interfaces.\n\n## TL;DR\nUnauthenticated network attackers can exploit a testing endpoint in 9Router (<= 0.5.4) to execute Server-Side Request Forgery (SSRF), gaining unauthorized access to internal services and cloud instance metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 8.6 (High)\n- **EPSS Score**: N/A\n- **Impact**: High Integrity, Low Confidentiality, Low Availability\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- 9Router AI dashboard platforms running version 0.5.4 or earlier\n- **9router**: <= 0.5.4 (Fixed in: `Verify config changes (Require API key ON)`)\n\n## Mitigation\n\n- Ensure that 'Require API key' is toggled to ON in the dashboard settings\n- Implement DNS lookup validation before issuing outbound network connections to user-controlled URLs\n- Restrict container egress traffic to block outbound calls to localhost, RFC 1918 subnets, and cloud metadata blocks\n\n**Remediation Steps:**\n1. Log in to the 9Router administrative dashboard\n2. Go to the Endpoint & Key configurations panel\n3. Enable the 'Require API key' option to block unauthenticated access\n4. Deploy egress network security rules in your firewall or VPC to isolate outbound calls\n\n## References\n\n- [GitHub Security Advisory GHSA-8g4w-4ffg-8vgx](https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx)\n- [CVE-2026-56677 Record](https://www.cve.org/CVERecord?id=CVE-2026-56677)\n- [9Router GitHub Page Repository](https://github.com/decolua/9router)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56677) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T01:32:24.606380Z"}, {"uuid": "05e41ac1-d536-409c-be3e-51def4bbbec9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3msy2swpzmi2g", "content": "CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance", "creation_timestamp": "2026-08-13T16:28:31.938441Z"}, {"uuid": "54e0230b-0c2e-4e4e-8110-0bef77039812", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56676", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcjdljext2l", "content": "CVE-2026-56676 - 9router: Image prefetch DNS rebinding allows SSRF to internal services\nCVE ID : CVE-2026-56676\n \n Published : July 10, 2026, 3:30 p.m. | 18\u00a0minutes ago\n \n Description : 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by ...", "creation_timestamp": "2026-07-10T15:59:25.230441Z"}, {"uuid": "c4e6f302-cce8-4beb-94c0-2f6ec4425744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56676", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd77cxr6b2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56676 \u0432 9Router: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/BCFBD733-E769-4590-9A91-34860E7998E1", "creation_timestamp": "2026-07-10T22:30:44.384092Z"}, {"uuid": "85440d6a-513a-419d-a733-4a81ff226d87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56675", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbiszh4227", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56675 \u0432 9Router: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/2D6DF05B-FE76-4C2F-9844-77C298A1CBA2", "creation_timestamp": "2026-07-10T23:11:50.631844Z"}, {"uuid": "fe03dd69-833f-49b7-a438-bf1947650ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56676", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdcgrbfoz2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56676 \u0432 9Router: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f\n\n\n\nhttps://kripta.biz/posts/94F7A410-8124-4900-9397-58DBFACDF9B0", "creation_timestamp": "2026-07-10T23:28:35.390698Z"}, {"uuid": "4438dc8c-b306-49f9-b9ca-e99e15e79df7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56675", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdd7lsx7p2s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56675 \u0432 9Router: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/D81CA90F-7064-4156-87FF-81E17870C69E", "creation_timestamp": "2026-07-10T23:42:29.080303Z"}, {"uuid": "5ca01b32-fb40-4343-9074-f611edded6ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56675", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfdwkqszg2w", "content": "\ud83d\udfe0 CVE-2026-56675 - High (8.3)\n\n9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as truste...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56675/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T19:00:39.334731Z"}, {"uuid": "2255eb9d-09e0-44d4-9842-6a72ef4f705d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "seen", "source": "https://t.me/CyberDispatch/2026", "content": "CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance.", "creation_timestamp": "2026-08-29T20:00:09.450271Z"}, {"uuid": "2783e127-df10-4c46-8e3d-3a86f8f4fb4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/10620", "content": "CVE-2026-5667: The Secret Life of Probe Requests \u2013 Mitsubishi MAC-577IF-2E WiFi Adapter\n\nhttps://innerfirez.github.io/posts/the-secret-life-of-probe-requests/", "creation_timestamp": "2026-07-15T12:00:04.034680Z"}, {"uuid": "2eb23770-f853-44eb-b4bb-cb564b361557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/10620", "content": "CVE-2026-5667: The Secret Life of Probe Requests \u2013 Mitsubishi MAC-577IF-2E WiFi Adapter\n\nhttps://innerfirez.github.io/posts/the-secret-life-of-probe-requests/", "creation_timestamp": "2026-07-16T00:00:19.813420Z"}, {"uuid": "7c4a5367-1351-4e7f-a6a5-f5da9c8bc937", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56679", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwtkfilw2a", "content": "CVE-2026-56679 - 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade\nCVE ID : CVE-2026-56679\n \n Published : July 15, 2026, 9:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : 9Router is an AI router & token saver. Prior to 0.5.4, th...", "creation_timestamp": "2026-07-16T00:05:36.437487Z"}, {"uuid": "f851230e-77f6-4b0d-9c11-0b7f785062c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5667", "type": "seen", "source": "https://t.me/CyberDispatch/2026", "content": "CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance.", "creation_timestamp": "2026-08-31T00:00:39.574677Z"}]}