CVE-2026-105110 Details
Description
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
A vulnerability allowing OS command injection has been identified in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices. This vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the CLI parameter. The absence of authentication and input sanitization in the parameter handling creates a critical security flaw, enabling complete device compromise.
Users are advised to block access to the ONT device via firewall rules and to contact their ISP for a firmware update or device replacement.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BlackHatExploitation/innbox_root | TuranSec | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | TuranSec |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Iskratel Innbox | <= 0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | TuranSec |