Altice Labs GR141DG (FiberGateway): unauthenticated root via Samba symlink traversal

Summary#

The Altice Labs GR141DG (FiberGateway) GPON ONT/router, distributed in Portugal by MEO, ships with an outdated and unpatched Samba file server (version 3.0.37). When USB storage is connected to the router, the device exposes an SMB share on the local network that can be accessed without authentication and is writable. Offensive Pulse estimates that more than 1.5 million devices are running affected firmware.

This Samba version is affected by CVE-2010-0926, a symbolic link traversal issue caused by its default configuration. Because the Samba service on the router runs with root privileges, a client on the local network can use the share to obtain read and write access to the entire device filesystem as root. With that access, an attacker can place a script in a directory of scheduled tasks that the system executes as root, which results in persistent code execution with full privileges.

Offensive Pulse also found that the device bootloader lacks firmware signature verification.

The issue was reported on 25 March 2026 through coordinated vulnerability disclosure mediated by the Portuguese National Cybersecurity Centre (CNCS / CERT.PT). The vendor has since released fixed firmware: all versions up to and including 3GN8020900r29 are affected.

Affected products#

• Vendor: Altice Labs
• Product: GR141DG (FiberGateway) GPON ONT/router
• Firmware: versions up to and including 3GN8020900r29
• Platform: Linux, ARM, RDK-B
• Vulnerable component: Samba 3.0.37
• Estimated exposure: more than 1.5 million devices (Offensive Pulse estimate)

Other GPON ONT models that share the same firmware base may also be affected. This has not been verified by Offensive Pulse.

Technical details#

The vulnerability is the result of several conditions present at the same time on the device:

1. Legacy Samba exposed on the LAN. The firmware includes Samba 3.0.37, a release that predates the upstream fix for CVE-2010-0926 (Samba 3.3.11, 3.4.6 and 3.5.0rc3).
2. Guest-accessible, writable share. When USB storage is connected, the router publishes a file share for it on the local network. The share accepts guest access, so no credentials are required, and it allows writes.
3. Wide links and UNIX extensions enabled. In the Samba releases affected by CVE-2010-0926, the default configuration combines the wide links and unix extensions options. When a writable share exists, this allows a client to create symbolic links that point outside the shared directory and to anywhere on the server filesystem. The server then follows those links when the client accesses them. This is the behaviour described in CVE-2010-0926.
4. Samba running as root. On the GR141DG the Samba service runs as the root user. In a typical Samba deployment the impact of CVE-2010-0926 is limited to the files that the connected user is already permitted to access. Here, every file operation performed through the share is carried out with root privileges.

Taken together, these conditions allow an unauthenticated client on the local network to read and modify any file on the device, not only the content of the USB storage.

The device runs scheduled tasks as root from a location on persistent, writable storage. Because the share grants root-level write access to that location, an attacker can add a task that the system will execute with full privileges. The result is persistent root code execution on the router.

This advisory intentionally describes the issue at a conceptual level. Exploitation details have been shared only through the coordinated disclosure process mediated by CNCS / CERT.PT.

Firmware signature verification#

Offensive Pulse also found that the device bootloader does not verify the signature of the firmware it loads. This advisory does not publish further detail on this point.

Firmware signature verification at boot is the control that prevents a device from running firmware that has not been authorised by the manufacturer. Without it, the device has no boot-time control to prevent modified firmware from running, which makes persistent tampering easier once an attacker has root access.

Attack requirements#

• Network position: access to the router's local network (LAN).
• USB storage: a USB storage device must be connected to and mounted on the router, since the vulnerable share is only available while USB storage is attached. This is the normal situation when the owner uses the router's USB port for network storage. In that case the attacker does not need physical access to the router: being on the local network is enough. Without a connected USB device, an attacker would need physical access to plug one in.
• Authentication: none. The share accepts guest access.
• User interaction: none.

Offensive Pulse scores the issue as 9.0 (Critical) under CVSS v4.0, with the vector CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The attack is carried out over the local network (AV:A) and requires USB storage to be attached to the router (AT:P).

Impact#

Successful exploitation results in full compromise of the router:

• Confidentiality: read access to the whole device filesystem as root, including system configuration and any secrets stored on the device.
• Integrity: write access to the whole filesystem as root, including system files and scheduled tasks.
• Availability: an attacker with root access can alter or disable any function of the device.
• Persistence: code placed in scheduled tasks runs as root on a recurring basis, giving persistent root code execution.
• Other devices on the network: the router is the gateway of the home network. With root access, an attacker controls the traffic of every device behind it and can intercept or manipulate it, for example by changing the DNS settings the router hands out.

The impact on subsequent systems is therefore rated high (SC/SI/SA:H), which gives a CVSS v4.0 base score of 9.0, Critical.

Mitigation#

The vendor has released firmware that fixes the issue. All versions up to and including 3GN8020900r29 are affected, so the main mitigation is to run a later version.

For users#

• Check the firmware version in the router's administration interface and make sure it is later than 3GN8020900r29. If it is not, contact the service provider.
• Disconnect USB storage from the router when it is not needed.
• Disable file sharing on the router if its settings allow it.
• Restrict access to the local network to trusted devices, and use a separate network for untrusted or guest devices where available.
• Keep applying firmware updates from the vendor or the service provider.

For the vendor#

• Update Samba to a currently supported release, or remove the file sharing service if it is not required.
• Set wide links = no and disable unix extensions for shares exposed to clients.
• Require authentication for access to shared storage and disable guest access by default.
• Run the file sharing service without root privileges, and ensure that system and scheduled task locations cannot be reached through any share.
• Enforce cryptographic signature verification of firmware and implement a secure boot chain.

Disclosure timeline#

days from discovery to full report

17days

days of coordinated disclosure with CNCS / CERT.PT

226days

days from discovery to publication

242days

AprMayJunJulAugSepOctNov

Coordinated disclosure · 226 days01020304050607

1. 019 Mar 2026day 0
   DiscoveryRoot access confirmed on the researcher's own test device
2. 0225 Mar 2026+16 d
   CERT.PT notifiedFirst contact with CNCS / CERT.PT
3. 0326 Mar 2026+1 d
   Report deliveredFull technical report sent to CNCS
4. 0411 Jun 2026+77 d
   CVE requestedCVE identifier requested
5. 05Jul 2026~+34 d
   Deadline extendedCERT.PT grants the vendor more time to fix; rollout planned for early Q4 2026
6. 06~Oct 2026~+92 d
   Fix rolloutVendor rollout of fixed firmware to all devices, scheduled for early Q4 2026
7. 076 Nov 2026~+22 d
   Advisory publishedPublic release of this advisory

In July 2026, CERT.PT informed Offensive Pulse that the vendor had asked for more time to fix the reported vulnerabilities, as the fix was technically more complex than expected. CERT.PT granted the extension under article 8(2) of CNCS Technical Instruction 01/2026, with the fix and its rollout to all devices scheduled for the beginning of the fourth quarter of 2026. The vendor did not object to publication once the vulnerabilities were fixed. In line with that, this advisory leaves out any detail that could put the operator's infrastructure at risk.

Credits#

Discovered and reported by Andrei Coman, Offensive Pulse.

References#

• CVE record for this issue: identifier pending assignment (CVE-PENDING). This advisory will be updated once the identifier is published.
• CVE-2010-0926 on cve.org
• CWE-59: Improper Link Resolution Before File Access ('Link Following')