CVE-2026-61542

Gearboy-hosted advisory reports unauthenticated Gearsystem MCP exposure

drhelius · Gearsystem MCP HTTP transport; Gearboy advisory/CNA package naming conflicts

First documented disclosure · Review checkpoint

Summary

Optional MCP HTTP mode exposes emulator tools beyond the documented localhost boundary.

Severity and exploitation evidence

High · 8.6/10 · CVSS 3.1. Severity source.

Exploitation not established: The original harness uses real MCP transport/dispatch with stubbed emulator internals and demonstrates unauthenticated mutation dispatch from a network peer. No malicious incident is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The transport binds all IPv4 interfaces, accepts requests without authentication or strict Host/Origin checks, and returns wildcard CORS.

Conditions required

The operator enables MCP HTTP mode and an attacker can reach its listener, typically port 7777.

Potential impact

Unauthorized emulator memory/register changes, execution control and state reads, plus media-file operations accepted by the emulator. Host code execution is not established.

Affected versions and configurations

The Gearboy CNA says versions before 3.8.7; the Gearboy-hosted advisory describes Gearsystem and lists its package through 3.8.6. The product-name mismatch remains unresolved.

Fix and mitigation status

3.8.7 is listed, but the cited release belongs to Gearboy. It is not independent proof that a Gearsystem release with that number fixes the defect.

Practical next steps

Disable HTTP mode or restrict it to loopback/trusted peers; enforce caller authentication and Host/Origin checks. Confirm product-specific patched versions with the maintainer.

Operating lesson

Verify the actual listener address and caller authentication of an agent tool server.

Evidence and limits

Advisory published June 12; CNA registration followed October 28. Inclusion is limited to the MCP integration's trust boundary. CNA 8.6 CVSS 3.1 uses a network vector; the original advisory gives 7.6 with an adjacent-network vector. Product/version disagreement is retained; the demonstration does not prove arbitrary host RCE.

Sources