CVE-2026-59800 is an OS command injection vulnerability affecting decolua's 9Router product before version 0.4.44. The issue exists in the unauthenticated POST /api/tunnel/tailscale-install endpoint, which is not protected by the dashboard middleware and thus lacks authorization checks. The sudoPassword parameter from the request body is written directly to the stdin of a 'sudo -S sh' child process. When sudo does not require a password prompt (due to running as root, NOPASSWD configuration, or cached credentials), the sudoPassword input is interpreted as shell commands, enabling remote unauthenticated attackers to execute arbitrary OS commands. Exploitation evidence was first reported by Shadowserver Foundation on July 4, 2026.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary operating system commands with elevated privileges on affected 9Router devices. This can lead to full system compromise, data theft, service disruption, or further network penetration. The vulnerability is critical with a CVSS 4.0 score of 9.2, reflecting its ease of exploitation and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity. Avoid running the affected service with root privileges or configure sudo to require password prompts to reduce risk. Follow vendor communications closely for updates on patches or official mitigations.