9router configuration injection can add a Hermes shell hook

What happened

A crafted provider address in 9router can insert extra Hermes configuration, including a shell hook that runs after a later model call.

The CVE was published on 10 October; the original researcher publication date is unconfirmed. The reported setup requires an authenticated 9router dashboard session, a shared home directory with Hermes and a later Hermes event. The researcher directly demonstrated configuration injection; command execution follows the documented hook behaviour. The CNA gives CVSS 3.1 score 6.4. Patch status remains unconfirmed as of 11 October.