What is the CVSS score of CVE-2026-31196?

CVE-2026-31196 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of GR140DG/GR140IG are affected by CVE-2026-31196?

ALTICE LABS GR140DG/GR140IG fiber gateway devices contain an authenticated command injection vulnerability that allows credential-holding attackers to execute arbitrary root commands via the…

How to fix or mitigate CVE-2026-31196?

Within 24 hours: Inventory all ALTICE LABS GR140DG and GR140IG devices in production and identify which are accessible to untrusted networks. Within 7 days: Implement access controls restricting administrative credentials to ISP-authorized personnel only and disable remote diagnostic features if operationally feasible; escalate to ALTICE LABS for patch timeline and interim guidance. Within 30 days: Enforce mandatory password rotation for all gateway administrative accounts and monitor authentication logs for anomalous diagnostic access patterns.

GR140DG/GR140IG CVE-2026-31196

EUVD-2026-27337 HIGH

OS Command Injection (CWE-78)

2026-05-05 mitre

GHSA-489r-v3h6-c72q

Command Injection N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 21:30 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

8.8 (HIGH)

CVE Published

May 05, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

The traceroute diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway, inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.

AnalysisAI

Authenticated command injection in ALTICE LABS GR140DG and GR140IG fiber gateways allows remote attackers with valid credentials to execute arbitrary commands as root through the traceroute diagnostic handler. The vulnerability exists in the /bin/httpd_clientside component where unsanitized destAddr parameters are passed directly to system() calls, enabling shell command substitution attacks. With CVSS 8.8 (High) but EPSS exploitation probability of only 0.04% (12th percentile), this vulnerability affects widely-deployed ISP-managed CPE devices in France (SFR network) but shows no evidence of active exploitation or public POC availability at time of analysis.

Technical ContextAI

This is a classic OS Command Injection vulnerability (CWE-78) in embedded Linux firmware for fiber-optic customer premise equipment. The /bin/httpd_clientside binary provides a web-based diagnostic interface where the traceroute function accepts a destAddr parameter containing destination IP addresses or hostnames. The vulnerable code passes this user-controlled input directly to the system() library call without sanitization, allowing shell metacharacter injection. Command substitution techniques like $(malicious_command) or malicious_command can break out of the intended traceroute command context. Since the httpd_clientside process runs with root privileges (common in embedded device architectures for hardware access), successful exploitation grants complete system control. The affected GR140DG/GR140IG are GPON fiber residential gateway models deployed by SFR (France) and potentially other Altice Group ISPs across Europe.

RemediationAI

No vendor-released patch or firmware update has been identified through available references at time of analysis. ISP customers using SFR-managed GR140DG/GR140IG devices should contact SFR technical support to request firmware status and potential updates, referencing CVE-2026-31196 and XEROD-2026-0002. For enterprise or self-managed deployments, implement immediate compensating controls: (1) Restrict management interface access to trusted internal networks only - block WAN-side access to administrative ports (typically TCP 80/443/8080) via firewall rules or device ACLs; (2) Disable remote management features if not operationally required, forcing local-only administration; (3) Implement strong authentication with complex passwords for all administrative accounts and regularly rotate credentials; (4) Monitor device logs for unusual traceroute diagnostic activity or failed authentication attempts; (5) If devices support it, disable the web-based diagnostics interface entirely and use CLI-based management. Note that disabling diagnostics may impact ISP remote troubleshooting capabilities. Long-term solution requires vendor firmware patch - escalate with Altice Labs and service provider for patch roadmap. Consider hardware replacement if vendor support is discontinued.