Post-Auth OS Command Injection in GR140DG Router (CVE-2026-31195) Advisory

Vulnerability Overview Vulnerability Name: Post-authentication OS command injection in GR140DG ping diagnostic handler (root context) CVE ID: CVE-2026-31195 CVSS Score: 8.8 Discovery Date: 2026-01-08 Vendor Notification Date: 2026-01-15 Public Disclosure Date: 2026-06-04 Affected Products Affected Product: GR140DG Fiber Router (CPE) Affected Versions: 3080020801E13, 3080020802B0A, 3080020803B0A Fixed Version: 3080020803B08 Remediation 1. Apply Firmware: Upgrade to version 3080020803B08 or later. 2. Configure Perimeter: Restrict WebUI access to the LAN, rotate WebUI credentials, and disable remote management. 3. Compensating Controls: Implement network segmentation between router management interfaces and untrusted LAN devices across network segments, and monitor for anomalous outbound traffic from the CPE. POC Code Additional Information Technical Details: The vulnerability exists in , which executes user-controlled input via , leading to OS command injection. Proof of Concept: A Python PoC reliably triggers the issue, but the PoC code is not provided. References: - CVE-2026-31195 (cve.org) - CVE-2026-31195 (NVD) - CWE-78: Improper Neutralization of Special Elements used in an OS Command - CAPEC-88: OS Command Injection - XEROD-2026-0002 - companion traceroute advisory (same root cause) Verify This Advisory Import the XEROD signing key (fingerprint available in the advisory index), then: Revision History Revision: 1.0 Date: 2026-06-04 Changes: Initial release. Firmware fix available in 3080020803B08. Attachments XEROD-2026-0001.txt XEROD-2026-0001.txt.asc XEROD-2026-0001.json (CSAF 2.0)

Goal Reached Thanks to every supporter — we hit 100%!

Post-Auth OS Command Injection in GR140DG Router (CVE-2026-31195) Advisory