CVE-2026-105110 in Innbox
Summary
by MITRE • 10/08/2026
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves a critical OS command injection flaw within the login.xgi Common Gateway Interface (CGI) endpoint of Iskratel Innbox GPON Optical Network Terminal (ONT) devices. This specific component serves as an interface for handling user authentication requests, typically processing credentials submitted via web forms or API calls to verify administrative access to the device's management plane. The core technical flaw resides in the improper validation and sanitization of input data passed through the CLI parameter associated with this endpoint. When a request is received, the backend script processes the provided parameters without adequately stripping out special characters that hold significance for shell interpretation, such as semicolons, ampersands, or pipe symbols. This lack of rigorous input filtering allows an attacker to inject arbitrary operating system commands directly into the execution context of the device's underlying Linux-based firmware.
From a technical perspective, this is a classic instance of CWE-78 Improper Neutralization of Special Elements used in an OS Command called 'OS Command Injection'. The vulnerability arises because the application constructs shell command strings by concatenating user-supplied input directly into system calls without employing safe APIs or parameterized execution methods. In many embedded systems like GPON ONTs, these CGI scripts often run with elevated privileges to perform administrative tasks such as rebooting the device, updating configurations, or managing network interfaces. Consequently, when an unauthenticated remote attacker crafts a malicious HTTP request containing shell metacharacters within the CLI parameter, the operating system interprets and executes these injected commands alongside the intended legitimate operations. This bypasses any authentication mechanisms because the injection occurs at the input processing stage before credential verification is fully enforced or exploited to escalate privileges post-authentication if applicable.
The operational impact of this vulnerability is severe due to the privileged nature of the execution environment. An unauthenticated remote attacker can achieve complete compromise of the affected device by executing arbitrary commands as root, which grants full control over the system. This capability allows for a wide range of malicious activities including but not limited to installing persistent backdoors, exfiltrating sensitive customer data such as internet usage logs or personal information stored on the device, modifying network configurations to redirect traffic through man-in-the-middle attacks, and using the compromised ONT as a pivot point to attack other devices within the local area network. Given that GPON ONTs are often deployed in large numbers by Internet Service Providers (ISPs) at customer premises, this vulnerability poses a significant risk to both individual privacy and broader ISP infrastructure security.
This exploit aligns with several tactics defined in the MITRE ATT&CK framework for enterprise environments, particularly T1059 Command and Scripting Interpreter where attackers use command-line interfaces or scripting languages like Bash or Python to execute malicious code. It also relates to T1190 Exploit Public-Facing Application as the vulnerability is accessible remotely via standard web protocols without requiring prior authentication. The ability to run commands as root corresponds to privilege escalation techniques, although in this specific case, it occurs directly due to the high-privilege context of the CGI script rather than a traditional exploitation chain from low to high privileges.
Mitigation strategies for this vulnerability must focus on immediate remediation and long-term secure development practices. The primary fix involves patching the firmware version affected by Iskratel to include proper input validation mechanisms that sanitize all user-supplied data before it is passed to system commands. Developers should implement allow-lists for acceptable characters in CLI parameters rather than relying solely on blocklists, which can be bypassed through encoding or alternative syntaxes. Additionally, employing parameterized execution functions instead of string concatenation when invoking shell processes will prevent the interpretation of injected metacharacters as executable code. For organizations managing large fleets of these devices, network segmentation is recommended to isolate ONTs from critical internal infrastructure, limiting the blast radius in case a device is compromised. Regular vulnerability scanning and monitoring for anomalous outbound connections can also help detect exploitation attempts early.