The ping diagnostic handler in /bin/httpd_clientside accepts a destination address parameter that is passed directly into a system() call without any sanitization. An authenticated attacker can exploit this by sending a carefully crafted destAddr value that triggers shell command substitution. This allows the attacker to execute arbitrary commands with root privileges on the affected device. The weakness is a classic command injection flaw.

ALTICE LABS and SFR France fibre CPE/Router/Gateway devices – specifically the GR140DG and GR140IG models.

The vulnerability is limited to authenticated remote attackers who can access the diagnostic interface. Once authenticated, the attacker can achieve full system compromise. No EPSS score is available, but the nature of the flaw and the privileges it grants make it a critical risk. The vulnerability is not listed in the CISA KEV catalog as of the last update.