CVE-2026-77853
Received Received - Intake

OS Command Injection in FF-RFI079I4 and FF-RFI078I4

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: JPCERT/CC

Description
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-77853
EUVD
EUVD-2026-78332

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lite-on ff-rfi079i4 to 02.01.15 (exc)
lite-on ff-rfi078i4 to 02.01.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS Command Injection vulnerability in Lite-On O-RU models FF-RFI079I4 and FF-RFI078I4. An authenticated user with access to the M-Plane (NETCONF) interface can execute arbitrary operating system commands on the device due to improper neutralization of special elements in commands.

Detection Guidance

To detect this vulnerability, check if your Lite-On O-RU models FF-RFI079I4 or FF-RFI078I4 are running firmware versions prior to v02.01.15. Verify if M-Plane (NETCONF) or SSH enable mode is accessible and if arbitrary OS commands can be executed by authenticated users.

Impact Analysis

An attacker with login access could run unauthorized commands on the device, potentially taking control of the system, accessing sensitive data, or disrupting network operations. This could lead to complete compromise of the affected O-RU devices.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected devices may face compliance violations, regulatory penalties, and reputational damage due to potential exposure of sensitive information.

Mitigation Strategies

Immediately update the firmware of affected Lite-On O-RU models to version v02.01.15 or later. Restrict access to the M-Plane (NETCONF) and SSH enable mode to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart