The vulnerability is an OS command injection flaw in the OptiLink ONT1GEW GPON router’s web management interface. The target_addr parameter of the formTracert and formPing administrative endpoints is not validated, allowing an authenticated user to inject arbitrary operating system commands. Those commands are executed with root privileges, providing full remote code execution and uncompromised device control. The weakness corresponds to CWE‑78 and can affect confidentiality, integrity, and availability of the device and any network attached to it.

Affected instances include all OptiLink ONT1GEW GPON routers running firmware version V2.1.11_X101 Build 1127.190306 and earlier. This encompasses any device deployed under that build, regardless of geographic location, as long as it exposes the vulnerable web interface.

The flaw carries a CVSS score of 9.4, indicating critical severity, but the EPSS score is below 1%, suggesting that exploitation in the wild is currently rare. The CVE is not listed in CISA’s KEV catalog. Successful exploitation requires the attacker to be authenticated against the web management interface, implying that attackers must obtain or guess valid credentials first. When authenticated, the attacker can execute any OS command and fully compromise the router. Shadowserver Foundation reported exploitation activity on 2025‑02‑04, confirming real‑world usage of the flaw.