CVE-2026-56681: 9router <=0.5.4 - Authentication Bypass
HoneyLabs honeypots recorded 3 probes matching CVE-2026-56681 from 3 distinct source IP addresses in the last 7 days, of which 1 on interactive sensors. Severity is rated high.
One source probed for CVE-2026-56681 on the interactive sensors. It did not send the exploit payload.
What the sensors show
Probes arrived on 2 of the 7 days in this window. The busiest day was 2026-11-08, with 2. One address, 161.33.30.233, sent 33% of them. The largest source network was AS203861 (Miteflux Technologies Ltd), with 33% of the probes from 1 address. Over the last 90 days the sensors recorded 85 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i201000_2b729b4bf6f3_36bf25f296df.
Request paths that identify it
- /api/v1/models
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 161.33.30.233 | 1 | Oracle Corporation | Japan |
| 31.59.160.24 | 1 | Miteflux Technologies Ltd | Sweden |
| 45.94.31.201 | 1 | 1337 Services GmbH | The Netherlands |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS203861 | Miteflux Technologies Ltd | 1 | 1 |
| AS210558 | 1337 Services GmbH | 1 | 1 |
| AS31898 | Oracle Corporation | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| Japan | 1 |
| The Netherlands | 1 |
| Sweden | 1 |
Captured requests
- /api/v1/models
Requests the interactive sensors answered
- GET /api/v1/models
HTTP client fingerprints
- b11cun010_00040000_c4b2c4aa
- b11cun050_00040017_1332d695
CVE report
Open a specific CVE from the CVE tracker.