CVE-2026-105110
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an…
- Risk score
- 81/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 2.8%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Red
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
Last activity 8 Oct 2026. Patch Forecast updates every hour.