Advisories · Technology
decolua 9router.
Every CVE that names decolua 9router among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.3 High
9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint
- decolua 9router
- Code injection
- CVSS 6.9 Medium
decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
- decolua 9Router
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable
- decolua 9router
- Server-side request forgery (SSRF)
- CWE-184
- CVSS 9.4 CriticalCritical · CVSS 9+
9router before 0.4.60 Remote Code Execution via default password
- decolua 9router
- Command injection
- CVSS 8.3 High
9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch
- decolua 9router
- Server-side request forgery (SSRF)
- CVSS 8.8 High
9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments
- decolua 9router
- Command injection
- CVSS 5.3 Medium
decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
- decolua 9router
- Privilege escalation
- Broken access control