CVE-2025-50753
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-08-29
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mitrastar | gpt-2741gnac-n2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Mitrastar GPT-2741GNAC-N2 devices allows an attacker with SSH access to a restricted shell to escape that restricted environment. By using the command `deviceinfo show file` with the argument "\n/bin/sh" (including quotes and newline), the attacker can drop into a root shell, gaining full root privileges on the device. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with physical or credential access to the device's SSH restricted shell to escalate privileges to root. This means the attacker can fully control the device, potentially altering configurations, intercepting or redirecting network traffic, or using the device as a foothold for further attacks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by attempting to access the device via SSH using the 'support' user credentials (often physically labeled on the modem). Once in the restricted shell, try executing the command: deviceinfo show file "\n/bin/sh". If this command drops you into a root shell, the device is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or disabling SSH access to the device, especially for the 'support' user account. Change or remove default credentials physically labeled on the device. Additionally, monitor for unauthorized SSH access attempts and apply any vendor patches or updates once available. [1]