The vulnerability in decolua 9router (before version 0.5.6) arises because the login rate limiting mechanism uses the client-supplied X-9r-Real-Ip header as the bucket key for tracking failed login attempts. Attackers can manipulate this header on each login attempt, causing each request to be treated as a new client and thus bypassing the five-attempt progressive lockout that would normally return HTTP 429 responses. This flaw permits unlimited password guessing attempts against the dashboard login endpoint (/api/auth/login), potentially leading to administrative access if the password is compromised. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-807. The issue has been addressed and fixed in version 0.5.6 of 9router.

An unauthenticated remote attacker can bypass the intended login attempt rate limiting by rotating the X-9r-Real-Ip header, enabling unlimited password guessing attempts against the dashboard login. This can lead to compromise of administrative credentials if the password is guessed successfully. The confidentiality impact is low (limited to potential credential compromise), with no direct integrity or availability impact reported.

Upgrade to decolua 9router version 0.5.6 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 0.5.6.