CVE-2026-31196 — n/a / n/a

Description (CNA)

OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0A inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://xerod.ai/advisories/XEROD-2026-0002
https://www.sfr.fr
https://www.alticelabs.com

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.