CVE-2026-63732 affects decolua's 9router before version 0.4.60. It involves a chain of vulnerabilities: a hardcoded default password (123456) that allows authentication on fresh installs, a bypass of the LOCAL_ONLY network gate via spoofed Host headers, and unvalidated arguments passed to child_process.spawn() during MCP plugin registration. An attacker can remotely authenticate using the default password, spoof the Host header to access local-only routes, and register a malicious MCP plugin that executes arbitrary OS commands when its SSE endpoint is triggered, leading to remote code execution on the host.

The vulnerability allows remote unauthenticated attackers to gain access using a hardcoded password, bypass network restrictions, and execute arbitrary code on the host operating system. This can lead to full system compromise of the affected 9router device.

Upgrade 9router to version 0.4.60 or later, where these vulnerabilities have been fixed. No other official remediation or temporary fixes are documented. Until patched, restrict network access to the device to trusted users and monitor for suspicious activity related to plugin registration.