The vulnerability in decolua 9router (before 0.4.80) involves improper restriction of excessive authentication attempts (CWE-307). The login rate limiter uses the X-Forwarded-For HTTP header to derive client identity for rate limiting. Since this header can be spoofed by an attacker, they can rotate its value on each login attempt to evade the 5-attempt threshold and progressive lockout durations. This enables unlimited brute-force attempts against the dashboard password. The vulnerability is addressed in version 0.4.80.

An unauthenticated remote attacker can bypass the login rate limiting mechanism by spoofing the X-Forwarded-For header, allowing unlimited brute-force attempts on the dashboard password. This can lead to unauthorized access if the attacker successfully guesses the password. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Upgrade to decolua 9router version 0.4.80 or later, where this issue is fixed. The vendor has provided an official fix that corrects the rate limiting logic to no longer rely on the attacker-controllable X-Forwarded-For header for client identification.