Post-Auth OS Command Injection in SFR GR140DG Router WebUI (CVE-2026-31196)

Vulnerability Summary: OS Command Injection in GR140DG traceroute Diagnostic Processor Vulnerability Overview Vulnerability ID: XEROD-2026-0002 (CVE-2026-31196) Severity: CVSS 8.8 (Critical) Vulnerability Type: Post-authentication OS Command Injection (root privileges) Affected Product: ALTICE LABS / SFR France GR140DG fibre router Vulnerability Principle: The router's WebUI diagnostic feature contains a command injection vulnerability. This feature directly concatenates the user-supplied parameter into a shell command for execution. Due to insufficient character filtering (only basic filtering via the library, which allows shell metacharacters), attackers can execute arbitrary system commands. Impact Scope Affected Firmware Versions: 30N8020801P13 30N8020802R0A 30N8020803R0A Impact Consequences: Privilege Escalation: The WebUI runs as . Successful exploitation grants full control over the device. Data Leakage: All device files, including credentials and configurations, can be read. System Tampering: Attackers can modify router status, firmware persistence mechanisms, and the downstream network. Service Disruption: The device can be rendered unavailable. Remediation 1. Firmware Upgrade: Upgrade to version 30N8020803R08 or higher. 2. Configuration Mitigation: Restrict WebUI access to the Local Area Network (LAN) only, rotate credentials, and disable remote management. 3. Network Isolation: Implement network segmentation between the router's management interface and untrusted LAN devices. Proof of Concept (PoC) The page provides Python-based PoC code to trigger the vulnerability: > Note: In actual exploitation, attackers would replace the parameter with arbitrary system commands (e.g., or ), as the parameter is not properly escaped or filtered and is passed directly to the function for execution.

Goal Reached Thanks to every supporter — we hit 100%!

Post-Auth OS Command Injection in SFR GR140DG Router WebUI (CVE-2026-31196)