The traceroute diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway inserts unsanitized user input into a system() call, permitting authenticated remote attackers to execute arbitrary commands as root by supplying crafted destAddr parameters that use shell command substitution. This results in full attacker control over the device, compromising confidentiality, integrity, and availability of all services it provides.

The vulnerability affects devices from ALTICE LABS / SFR France that expose the /bin/httpd_clientside path, specifically the GR140DG and GR140IG fibre CPE/Router/Gateway models. No specific firmware version information is provided; the flaw is present in any model utilizing the vulnerable traceroute handler.

The CVSS score is 8.8, indicating a high severity vulnerability. The EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Nevertheless, the vulnerability permits authenticated remote attackers to execute arbitrary commands with root privileges via crafted destAddr parameters to the traceroute handler. Attackers with network access to the device can send shell metacharacter‑laden destAddr inputs to trigger system calls, giving them full control over the device’s confidentiality, integrity, and availability.