CVE-2023-33381

Deeper analysis

A command injection vulnerability tracked as CVE-2023-33381 affects the ping functionality in the MitraStar GPT-2741GNAC router running firmware version AR_g5.8_110WVN0b7_2. The flaw, assigned CWE-78, permits an authenticated user to supply specially crafted input that results in execution of arbitrary operating-system commands on the device. It carries a CVSS 3.1 base score of 7.2, reflecting network attack vector, low complexity, and high impact across confidentiality, integrity, and availability when the attacker holds administrative credentials.

An authenticated administrator can exploit the issue remotely by submitting malicious payloads through the router’s ping interface, thereby gaining the ability to run arbitrary commands with the privileges of the underlying operating system. Successful exploitation can lead to full device compromise, including the ability to alter configuration, exfiltrate data, or pivot further into the network.

Public references include a proof-of-concept repository demonstrating the injection technique, along with vendor sites for MitraStar and the affected product; no official advisory or firmware patch addressing the flaw is referenced in the available sources. The CVE’s EPSS score currently stands at 0.5803 with a recorded peak of 0.6030.