EUVD-2026-112412Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRoute to INADDR_ANY listener on port 7777
-
DeliverySend unauthenticated POST /mcp
-
ExploitInitialize MCP session and tools/list
-
ExecutionInvoke write_memory / write_z80_register
-
ImpactMutate emulator memory, registers, and execution state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable listener exists ONLY when the operator starts the optional HTTP transport via './gearboy --mcp-http' (the default MCP transport is stdio, which is not exposed), so this is opt-in, not a default-config remote flaw. When that mode is active on an affected version (<= 3.8.6), there are no further conditions for a reachable peer: the socket binds INADDR_ANY on port 7777, and POST /mcp reaches MCP dispatch with no Authorization, Host, or Origin check - even a garbage bearer token does not block it. Limiting factors that reduce real-world risk: the attacker must have network routing to the host and port; impact is confined to the emulator process, debugging state, and local files the emulator loads as media (no demonstrated host RCE); and a GEARBOY_MCP_HTTP_TOKEN, if set on patched builds, plus the 3.8.7 Host/Origin/loopback-bind defaults, close the exposure. |
| Impact | Signals are moderately consistent but point to a bounded, not catastrophic, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 8.6 and correctly reflects remote, low-complexity, unauthenticated reachability once the listener is up - matching CWE-306 (missing authentication) and the GHSA advisory's source-code evidence (socket bound to INADDR_ANY, /mcp dispatch with no Authorization/Host/Origin gate, wildcard CORS). The GitHub-issued advisory includes a documented working reproduction (unauthenticated tools/list and write_memory succeeding, and succeeding again with a garbage bearer token, with a loopback-bind negative control), so exploitability is well substantiated rather than theoretical. Counterweights: there is NO CISA KEV listing (not actively exploited per available data) and NO EPSS score provided, so widespread-exploitation probability cannot be quantified from the input. The vuln.today decision label is 'this_week', not 'act_now'/'emergency'. Crucially, the HTTP transport is an optional, non-default mode (default MCP transport is stdio), and the impact is explicitly bounded to the emulator process, debugging state, and local files the emulator loads as media - the advisory states host code execution was NOT demonstrated. Net: a genuine authentication-exposure bug worth patching on a this-week cadence for anyone who enabled --mcp-http, but the 'RCE' framing overstates it and the rare real-world footprint limits mass-exploitation risk; treat as targeted/opportunistic rather than internet-wide. |
| Exploit ScenarioDerived | A developer runs Gearboy/Gearsystem with the optional '--mcp-http' debugging mode; although docs and the startup log claim localhost:7777, the socket actually binds all IPv4 interfaces. An attacker with network routing to the host (e.g. a peer on the same LAN or container network) sends an unauthenticated POST to /mcp, initializes an MCP session, and invokes mutating tools such as write_memory and write_z80_register. The GHSA advisory includes a working reproduction of exactly this, including the call succeeding even when a garbage bearer token is supplied. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Gearboy's optional --mcp-http MCP transport (the affected Gearsystem component) exposes emulator and debugger control tools to any network peer that can route to port 7777, because the socket binds INADDR_ANY while documentation and runtime logging describe a localhost-only service. Unauthenticated POST requests to /mcp reach dispatch with no Authorization, Host, or Origin gate, and even a garbage bearer token does not block them, letting a remote caller initialize an MCP session, list tools, and invoke mutating operations such as write_memory and write_z80_register. Exposure requires the operator to have started the HTTP transport explicitly (stdio is the default MCP mode); impact is bounded to the emulator process, debugging state, and local files the emulator loads as media, with no demonstrated host code execution. Gearboy 3.8.7 contains the patch, and the advisory includes a proof-of-concept reproduction; no confirmed public exploit code or CISA KEV listing is available.
RemediationAI
Vendor-released patch: Gearboy 3.8.7, which defaults the HTTP bind address to 127.0.0.1, logs the actual bind address, validates Host and browser Origin values against the configured endpoint, adds the --mcp-http-address option for explicit non-loopback binds, and supports bearer-token authentication via the GEARBOY_MCP_HTTP_TOKEN environment variable (documented in MCP_README.md and README.md). Upgrade per https://github.com/drhelius/Gearboy/releases/tag/3.8.7. Where upgrading is not immediately possible, do not start --mcp-http on untrusted networks: keep using the default stdio MCP transport, or bind the HTTP listener to loopback with --mcp-http-address 127.0.0.1 if running a build that supports it - the trade-off is that remote AI clients then lose connectivity and must run locally. Additionally, block inbound TCP 7777 at the host or network firewall and avoid exposing the listener beyond a trusted segment; the advisory notes that updated builds accept unauthenticated requests when GEARBOY_MCP_HTTP_TOKEN is unset, so setting that variable is required for authentication even after patching. Per the vendor's security model, use a non-loopback address only on trusted networks or with bearer-token authentication enabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gearboy embeds a Model Context Protocol server so AI agents can drive execution control, memory inspection, breakpoints, disassembly, and save-state operations; stdio is the default transport, and an opt-in HTTP transport is implemented in platforms/shared/desktop/mcp/mcp_transport.h. The root cause is CWE-306 (Missing Authentication for Critical Function): the transport sets addr.sin_addr.s_addr = INADDR_ANY before bind() and then logs a hardcoded http://127.0.0.1:<port> URL, so the implementation silently widens a documented loopback boundary to all IPv4 interfaces. The request handler forwards POST bodies on /mcp into the MCP dispatch path without validating Authorization, Host, or Origin, and both the JSON responses and the OPTIONS preflight handler return Access-Control-Allow-Origin: *, which compounds browser-reachable exposure. The advisory's reproduction used the genuine upstream transport and server files with stubbed emulator internals, confirming unauthenticated tools/list (61 tools including write_memory and write_z80_register), a successful memory mutation at offset 0xC000, the same mutation succeeding with Authorization: Bearer garbage, and a loopback-bind negative control that returned connection refused from the same-network peer.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Remote, low-complexity, unauthenticated reach to an open /mcp (AV:N/AC:L/PR:N/UI:N); within the unchanged emulator scope, arbitrary memory/register writes give I:H, state/screenshot reads C:L, and reset/disruption A:L.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional --mcp-http mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described platforms/shared/desktop/mcp/mcp_transport.h transport, the socket binds INADDR_ANY, normally on port 7777, and POST requests to /mcp reach dispatch without Authorization, Host, or Origin checks. Responses and OPTIONS advertise Access-Control-Allow-Origin: *. A peer can initialize an MCP session and invoke exposed emulator/debugging operations; even a garbage bearer token does not block dispatch, while a loopback-bind negative control prevents network access. The reported impact is bounded to the emulator process, debugging state, and local files accepted as media, rather than demonstrated host code execution. Gearboy 3.8.7 contains a patch.
Technical POC Analysis
CWE-306 (Missing Authentication for Critical Function), compounded by an undocumented bind-address widening.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-61542 is a high-severity flaw in Gearboy's optional MCP HTTP transport (Gearsystem component) that allows unauthenticated remote attackers to control emulator and debugger functions if the service is enabled. Organizations using Gearboy for development or testing must promptly restrict access or apply mitigations to prevent unauthorized manipulation, though no host code execution has been demonstrated.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to port 7777 via firewall rules, disabling the MCP HTTP transport if not required, and monitoring for unauthorized access attempts.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB