The traceroute diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway inserts unsanitized user input into a system() call, permitting authenticated remote attackers to execute arbitrary commands as root by supplying crafted destAddr parameters that use shell command substitution. This results in full attacker control over the device, compromising confidentiality, integrity, and availability of all services it provides.

The vulnerability affects devices from ALTICE LABS / SFR France that expose the /bin/httpd_clientside path, specifically the GR140DG and GR140IG fibre CPE/Router/Gateway models. No specific firmware version information is provided; the flaw is present in any model utilizing the vulnerable traceroute handler.

The CVSS and EPSS scores are not available, so the quantitative risk is unclear; however, the flaw is not listed in the CISA KEV catalog, indicating no confirmed public exploits yet. Its potential for authenticated remote command execution as root makes it a high‑severity vulnerability, and attackers with network access could exploit the bug by sending a destAddr parameter containing shell metacharacters, triggering arbitrary root commands.