Logo
Retour à la veille

CVE-2026-63732

Publié : 23 juillet 2026
Modifié : 23 juillet 2026
Lien officiel NVD
Score CVSS
9.9
CRITICAL

Description détaillée

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin (e.g. node -e <payload>) to achieve arbitrary code execution on the host operating system when the plugin's SSE endpoint is triggered.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://github.com/decolua/9router/security/advisories/GHSA-4922-8r65-fq26https://www.vulncheck.com/advisories/9router-before-remote-code-execution-via-default-password

Dernières Vulnérabilités

CVE-2026-50044

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.

VOIR DÉTAILS

CVE-2026-44955

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.

VOIR DÉTAILS

CVE-2026-42933

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.

VOIR DÉTAILS