OS Command Injection in Iskratel Innbox GPON ONT

Executive Summary

CVE-2026-105110 is an OS Command Injection vulnerability in Iskratel Innbox GPON ONT devices. It allows unauthenticated remote attackers to execute arbitrary commands as root via the login.xgi CGI endpoint by manipulating the CLI parameter. The flaw occurs because user input is passed directly to a shell without proper sanitization or authentication checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the /login.xgi endpoint with unusual CLI parameters. Use tools like curl to send test requests with harmless commands (e.g., 'echo test') and check for command output in publicly accessible directories. Example: curl 'http://<target-ip>/login.xgi?CLI=echo test' and inspect responses for command execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables full device compromise. Attackers can gain root access, read or write files, extract credentials, and install persistent backdoors. Exploitation involves sending a crafted HTTP request with a command payload, which executes and stores output in a publicly accessible directory for retrieval.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote code execution as root, enabling full device compromise. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /login.xgi endpoint via firewall rules or disable it if unused. Apply vendor patches if available. Implement strict input validation for all CGI parameters. Monitor for suspicious activity and unauthorized file modifications in web-accessible directories.

Useful 0 Not Useful 0