MitraStar GPT-2741GNAC-N2-SV EUVD-2026-82467

Requires (1) valid authentication to the router's web management interface (PR:L) and (2) network reachability to that interface - typically LAN-side, though risk escalates sharply if remote/WAN management is enabled. Exploitation targets the ping/diagnostics feature reachable at /cgi-bin/device-management-utilities-internet.cgi on the specific device MitraStar GPT-2741GNAC-N2-SV running firmware BR_g8.10_1.11(WVK.0)b46; the flaw is triggered by appending shell metacharacters to concatenate additional commands onto a diagnostics parameter in a POST request. Limiting factors: only this model/firmware is named, deployment is a regional ISP-provisioned device, and credentials are mandatory - reducing exposure where default/weak passwords have been changed and remote management is disabled.

The vendor CVSS of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, authenticated OS command injection yielding full compromise of the affected router - plausible for a CGI diagnostics handler that concatenates user input into a shell command. However, the exploitation-probability signals sharply contradict the raw severity: EPSS is only 0.15% (5th percentile), there is no CISA KEV listing, and no confirmed weaponized exploit. The single GitHub reference belongs to the reporting researcher (FelpM) and, for this class of disclosure, typically contains a technical write-up and/or proof-of-concept rather than mass-scanning tooling. Two structural factors cap real-world risk well below the 8.8 headline: (1) PR:L means the attacker must already hold valid router credentials, and (2) MitraStar CPE routers are ISP-distributed regional devices (the 'BR' firmware string indicates a Brazilian ISP build) with a narrow deployment footprint. Net: this is a genuine authenticated root-level flaw worth patching on affected devices, but it is a targeted/limited-blast-radius issue, not a widespread exploitation priority. Note the CPE ('cpe:2.3:a:n/a:n/a:*') and EUVD affected-version string ('n/a n/a') are placeholders and provide no machine-usable product/version data - affected scope must be taken from the free-text description (firmware BR_g8.10_1.11(WVK.0)b46).

An attacker with valid (possibly default or weak ISP-provisioned) router credentials logs into the web management interface and sends a crafted POST to /cgi-bin/device-management-utilities-internet.cgi, appending shell metacharacters to a ping/diagnostics parameter so the concatenated value is executed as an OS command. This grants command execution in the router's context (typically root on embedded CPE), enabling credential theft, DNS/traffic manipulation, or persistent implantation. A researcher GitHub repository is referenced and likely documents the exact request/PoC, lowering the barrier to reproduction.