A critical vulnerability in 9router allows unauthenticated remote attackers to achieve full system compromise through a chain of exploits.

The software suffers from improper neutralization of special elements used in OS commands (CWE-78). By exploiting a hardcoded default credential to gain access, an attacker can bypass network restrictions and inject malicious payloads into child processes to execute arbitrary commands on the host.

The potential for unauthenticated remote code execution represents the highest level of security risk. Successful exploitation could lead to full system takeover, unauthorized access to sensitive data, and complete loss of control over the infrastructure. Given the CVSS score of 9.9, the impact on availability, integrity, and confidentiality is total.

Immediate Action: Update decolua 9router to version 0.4.60 or later immediately to resolve the command injection and credential flaws.

Proactive Monitoring: Audit system logs for unexpected child processes or unusual plugin registration activity.

Compensating Controls: Ensure the 9router instance is not exposed to the public internet and restrict access to authorized management networks only.

Public Exploit Available: Unknown.

This vulnerability is severe and requires immediate attention. Administrators must prioritize updating to the patched version, as the combination of default credentials and command injection creates a trivial path for attackers to gain full control of the host operating system.