CVE-2026-31195

View on CVE.org
Published May 5, 2026 CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Description
OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0A inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.

Analysis

AI-generated

Technical impact

An OS command injection vulnerability exists in the ping diagnostic handler in /bin/httpd_clientside on ALTICE LABS / SFR France GR140DG fibre routers with firmware versions 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0A. Unsanitized user input from the destAddr parameter is inserted directly into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.

Affected Systems

ALTICE LABS and SFR France fibre CPE/Router/Gateway devices – specifically the GR140DG model.

Risk and Exploitability

The vulnerability is limited to authenticated remote attackers who can access the diagnostic interface. Once authenticated, the attacker can achieve full system compromise. The CVSS score is 8.8, indicating a high severity. The EPSS score is 0.01275%, indicating a very low probability of exploitation, but the nature of the flaw and the privileges it grants make it a critical risk. The vulnerability is not listed in the CISA KEV catalog as of the last update.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any vendor firmware update that sanitizes the destAddr input or replaces the insecure system() call.
  • If a patch is not yet available, block or disable access to the /bin/httpd_clientside diagnostic endpoint from external networks.
  • Restrict the allowed characters in the destAddr parameter or enforce strict input validation to eliminate shell command substitution.
  • Ensure that the diagnostic interface requires strong authentication and consider enabling two‑factor authentication if supported.

Generated by OpenCVE AI on June 18, 2026 at 04:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title OS Command Injection in ALTICE LABS / SFR France GR140DG Router
Type Values Removed Values Added
Title OS Command Injection in ALTICE LABS / SFR France GR140DG Router
Type Values Removed Values Added
References
Type Values Removed Values Added
Description The ping diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway, inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution. OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0A inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.
References
Type Values Removed Values Added
Title Root Command Execution via Unsanitized Destination Address in Ping Diagnostic Handler
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Altice
Altice gr140dg
Altice gr140ig
Vendors & Products Altice
Altice gr140dg
Altice gr140ig
Type Values Removed Values Added
Title Root Command Execution via Unsanitized Destination Address in Ping Diagnostic Handler
Weaknesses CWE-78
Type Values Removed Values Added
Description The ping diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway, inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.
References
Earlier changes (4)
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Jun 15, 2026, 2:42 PM
Reserved
Mar 9, 2026, 12:00 AM

View source JSON

Updated
May 6, 2026, 6:08 PM

JSON

Status
Awaiting Analysis
Published
May 5, 2026, 4:16 PM
Modified
Jun 17, 2026, 10:33 AM

View source JSON

No data.

Updated
Jun 18, 2026, 4:15 AM

JSON