Executive brief
The MitraStar GPT-2742GX4X5v6-SV is a gateway/router device used in ISP deployments to provide internet and network services to customers. An authenticated attacker can inject arbitrary shell commands through the device management web interface, bypassing input filters using URL-encoded characters. This allows an attacker with valid credentials to gain full control of the device, read sensitive files, modify configurations, and potentially use it as a pivot point to attack connected networks.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the /cgi-bin/device-management-utilities-internet.cgi endpoint. The vulnerable code concatenates user-supplied input directly into system shell commands without proper validation. The sanitization function uses a denylist approach (blocking specific characters like semicolons), which attackers bypass using URL-encoded command concatenators such as "%26%26" (&&). The vulnerable code path processes the payload through the libbemodules.so library, which calls the CCC_Ping binary with the unsanitized input via the unsafe system() function. An authenticated attacker can execute arbitrary commands and read/modify device files. Patches or firmware updates should replace system() calls with safer exec-family functions and implement allowlist-based input validation.
Affected products
- MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3
Timeline
- 2026-09-15: disclosed: CVE-2026-52484 published on NVD