HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-5842 — A security vulnerability has been detected in decolua 9router up to 0.3.47. The ...

·Source: NIST NVD

Updated:

Executive Summary

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this iss

Analysis

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component. CVSS Score: 7.3. Published: 2026-04-09T05:16:06.380.

Indicators of Compromise (1)

CVE (1)
CVE-2026-5842
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 9, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-102361 — mall4j through 4.0 contains a missing authentication vulnerability in the PUT /u...

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

CVE-2026-102361
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-101264 — A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unk...

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101264
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-101263 — A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some...

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-101263
NIST NVD