What is the CVSS score of CVE-2026-31195?

CVE-2026-31195 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of GR140DG Router are affected by CVE-2026-31195?

ALTICE LABS GR140DG and GR140IG fibre routers contain a command injection vulnerability in the diagnostic ping handler that allows authenticated administrators or network operators to execute…

How to fix or mitigate CVE-2026-31195?

Within 24 hours: Identify and inventory all ALTICE LABS GR140DG and GR140IG routers in your network and document their firmware versions; restrict administrative access to these devices to essential personnel only and enforce multi-factor authentication where available. Within 7 days: Review administrative access logs for suspicious activity; implement network segmentation to isolate affected routers from sensitive systems; contact ALTICE LABS technical support for interim guidance and patch timeline. Within 30 days: Evaluate replacement routers or alternative vendor solutions; develop firmware update procedures for deployment once vendor patch is released; conduct security awareness training for administrators on credential management.

GR140DG Router CVE-2026-31195

EUVD-2026-27335 HIGH

OS Command Injection (CWE-78)

2026-05-05 mitre

GHSA-48q2-ffv8-pgrw

Command Injection N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 21:31 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

May 05, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

The ping diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway, inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.

AnalysisAI

Command injection in ALTICE LABS GR140DG and GR140IG fibre routers allows authenticated remote attackers to execute arbitrary commands as root. The ping diagnostic handler in /bin/httpd_clientside accepts unsanitized user input in the destAddr parameter and passes it to a system() call, enabling shell command substitution. SSVC indicates total technical impact with no confirmed exploitation; EPSS score of 0.04% (12th percentile) suggests low observed exploitation activity, though the availability of a detailed security advisory (XEROD-2026-0001) may increase attack surface awareness among threat actors.

Technical ContextAI

This vulnerability affects the web-based diagnostic interface of ALTICE LABS fibre gateway devices (GR140DG and GR140IG models), commonly deployed by SFR France for residential and small business internet connectivity. The flaw manifests in the ping diagnostic handler within /bin/httpd_clientside, a binary responsible for processing client-side HTTP requests for network diagnostic tools. The code inserts user-supplied input from the destAddr parameter directly into a system() function call without proper sanitization or validation. This is a classic CWE-78 (OS Command Injection) vulnerability, where shell metacharacters and command substitution operators (such as backticks, $(), semicolons, or pipe symbols) in the destAddr field are interpreted by the underlying shell rather than treated as literal data. Because the httpd_clientside process runs with elevated privileges, successful exploitation yields root-level command execution on the embedded Linux platform. The CVSS vector PR:L indicates low-privileged authentication is required, meaning attackers need valid credentials to the router's administrative interface-typically obtained through default credentials, credential stuffing, or social engineering against residential users.

RemediationAI

Primary mitigation requires firmware update from ALTICE LABS or SFR France-contact service provider for patch availability and deployment timeline, as affected firmware versions are not publicly disclosed. Until patched firmware is available, implement layered compensating controls: (1) Restrict administrative access to the router's web interface by disabling remote management features and permitting connections only from trusted internal IP addresses via firewall rules-this prevents external attackers from reaching the authenticated exploitation surface but does not protect against compromised LAN devices or malicious insiders. (2) Change default administrative credentials immediately to complex, unique passwords (16+ characters)-this raises the authentication barrier but does not eliminate risk if credentials are subsequently compromised via phishing or traffic interception. (3) Monitor router logs for diagnostic tool access patterns, particularly ping requests with unusual characters (backticks, semicolons, dollar signs, pipes) in destination fields-logging may be limited on embedded platforms. (4) For enterprise deployments, consider network segmentation to isolate customer gateways from critical infrastructure. Refer to XEROD-2026-0001 advisory (https://xerod.io/advisories/XEROD-2026-0001) for additional technical details. None of these controls eliminate the vulnerability-firmware patching remains the definitive remediation.