The 9router dashboard login rate limiter derives client identity directly from the X-Forwarded-For HTTP header without verifying if the header is from a trusted proxy. This allows a remote attacker to spoof the X-Forwarded-For header on each login attempt, causing the rate limiter to treat each request as coming from a different client IP. Consequently, the rate limiter's lockout mechanism is bypassed, allowing unlimited brute-force login attempts. The vulnerability is due to the use of untrusted X-Forwarded-For values as keys for rate-limiting state. The issue is present in versions prior to 0.4.77.

An attacker can bypass the login brute-force protection by spoofing the X-Forwarded-For header, effectively resetting the rate-limit counter on every login attempt. This renders the lockout mechanism ineffective, allowing unlimited password guessing attempts. If the default dashboard password is still in use, the attacker can gain unauthorized access more easily. The vulnerability compromises the confidentiality, integrity, and availability of the 9router dashboard authentication mechanism.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should ensure that 9router is not directly exposed to untrusted networks or is deployed behind a reverse proxy that properly overwrites or validates the X-Forwarded-For header. Avoid using default dashboard passwords to reduce impact. Implement additional authentication protections if possible.