CVE-2024-9977

CVE-2024-9977 is an OS command injection flaw (CWE-78) in the Firewall Settings Page of the MitraStar GPT-2541GNAC DSL gateway, specifically in the /cgi-bin/settings-firewall.cgi script, where the SrcInterface argument is manipulated and passed into a system command. An attacker triggers it remotely by submitting a crafted SrcInterface value to that endpoint; the source classified the bug as critical, while the published CVSS 4.0 score is 5.1 (medium) with PR:H, indicating privileged/administrative access to the gateway's web interface is required and rated impact on confidentiality, integrity and availability is limited. Successful exploitation yields arbitrary command execution on the gateway with the web service's privileges, which on an ISP-supplied router can enable traffic manipulation or a foothold into the subscriber's LAN. Only the GPT-2541GNAC running firmware BR_g5.6_1.11(WVK.0)b26 is confirmed affected; these gateways are typically provisioned by internet service providers, so ISPs and their subscribers running this model are the exposed population. The exploit has been publicly disclosed and may be used, though no standalone PoC is catalogued and the issue is not yet in CISA KEV; EPSS assigns a 22.9% probability of exploitation within 30 days (98th percentile), and vendor notification was hampered by a broken contact email, so a patch may not be widely available yet.

What to do: Audit any GPT-2541GNAC gateways you manage for firmware BR_g5.6_1.11(WVK.0)b26 and restrict the web management interface so /cgi-bin/settings-firewall.cgi is not reachable from untrusted networks (e.g., disable WAN-side HTTP/HTTPS management or apply source-IP restrictions). Because the vendor's contact address was failing at disclosure, monitor MitraStar or your ISP support channel for corrected firmware and apply it promptly rather than waiting for an automatic push; given the 98th-percentile EPSS, treat internet-exposed units as likely targets.