CVE-2025-50753 - Mitrastar GPT-2741 GNAC-N2 root privilege escalation

| 1 min read

Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell. This is called the "support" user and the credential to log in is a sticker on the modem as provided by Vivo (Telefonica Brasil) on their Vivo Fibra offer.

The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing "\n/bin/sh" (quotes included, note the newline special character) to the argument of this command will drop a root shell.

Publically archived at https://gist.github.com/geraldog/2d07fdedbbb79d822e9df4b75f882a63 as per CVE rules.