CVE-2025-50753 - Mitrastar GPT-2741 GNAC-N2 root privilege escalation

| 1 min read

Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell. This is called the "support" user and the credential to log in is a sticker on the modem as provided by Vivo (Telefonica Brasil) on their Vivo Fibra offer.

The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing "\n/bin/sh" (quotes included, note the newline special characters) to the argument of this command will drop a root shell.