EUVD-2026-94812
GHSA-99gm-3j5p-pvr2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network command injection with no user interaction yields PR:N/UI:N/AV:N/AC:L; root execution gives full C:H/I:H/A:H, with impact confined to the device (S:U).
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
3DescriptionCVE.org
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
AnalysisAI
Unauthenticated remote OS command injection in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices lets any attacker who can reach the device's web management interface run arbitrary operating-system commands with root privileges by supplying shell metacharacters through the CLI parameter. Rated CVSS 9.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw requires no authentication, no user interaction, and no non-default configuration, giving a full compromise of the device's confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The specific prerequisite is network reachability of the login.xgi CGI endpoint on an Iskratel Innbox GPON ONT; the attacker supplies the malicious OS command through the CLI parameter of that endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the supplied intelligence, and no vendor advisory or fixed firmware version is referenced - the only public link is the exploit proof-of-concept at https://github.com/BlackHatExploitation/innbox_root - so the immediate priority is containment rather than upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Iskratel Innbox GPON ONT in the estate and determine which ones expose the login.xgi web management interface to the public internet or any untrusted network; immediately block inbound TCP 80/443 and any other management ports to these devices at the WAN edge and ISP access-network boundary, and disable remote WAN-side web management and remote HTTP provisioning on all units where it is not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today