CVE-2026-105110CWE-306CWE-78command-injection
CVE-2026-105110
Critical · published October 8, 2026
What it is
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
The record
Technical detail
- CVSS v3.1
- 9.8 · CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- EPSS
- 0.02788 · 86.3th percentile
- Weaknesses
- CWE-306 · Missing Authentication for Critical Function; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2026-10-08T13:16Z
References (1)
EPSS history
Timeline