CVE-2026-63732

Received Received - Intake

Hardcoded Password and Code Execution in 9router

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin (e.g. node -e <payload>) to achieve arbitrary code execution on the host operating system when the plugin's SSE endpoint is triggered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-63732

Affected Vendors & Products

Vendor	Product	Version / Range
9router	9router	to 0.4.60 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-63732 affects 9router versions 0.4.59 and earlier. It combines three issues: a hardcoded default password (123456) for any fresh install, a Host header spoofing flaw to bypass network restrictions, and unvalidated arguments in child_process.spawn() for MCP plugin registration. An attacker can exploit these to gain remote unauthenticated access, bypass local-only protections, and execute arbitrary code on the host system.

Detection Guidance

Check for unauthorized logins using the default password 123456. Inspect network traffic for spoofed Host headers bypassing LOCAL_ONLY restrictions. Review MCP plugin registrations for unvalidated arguments or suspicious node -e payloads.

Impact Analysis

This vulnerability allows remote attackers to fully compromise the system hosting 9router. They can log in without credentials, access restricted local services, and execute malicious code with the same privileges as the application. This could lead to data theft, system damage, or further network infiltration.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system security. It enables unauthorized access to sensitive data and systems, which could result in breaches of GDPR (data protection), HIPAA (health information), and other regulations mandating strong access controls and system integrity.

Mitigation Strategies

Upgrade 9router to version 0.4.60 or later. Disable the default password and enforce strong authentication. Restrict network access to local-only routes. Validate all MCP plugin arguments and block node -e payloads.

Hi! I’m here to help you understand CVE-2026-63732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70