The vulnerability is a command injection in the login.xgi CGI endpoint of Iskratel Innbox GPON ONT devices. An attacker can supply a specially crafted CLI parameter and cause the device to execute arbitrary commands as the root user. This leads to full system compromise, allowing the attacker to alter configuration, install malware, exfiltrate data, and maintain persistence. The weakness is reflected in the CWE-306 (Missing Authentication) and CWE-78 (OS Command Injection) identifiers. The potential impact is therefore complete loss of confidentiality, integrity, and availability for the affected device and could extend to the broader network if the device is part of a distributed optical access system.

The affected products are Iskratel Innbox GPON ONT devices. No specific firmware or model versions are listed in the available information. The vulnerability applies to any device that exposes the login.xgi endpoint and accepts the CLI parameter without authentication.

The CVSS score of 9.3 indicates critical severity. The EPSS score is 3%, indicating a low-to-moderate likelihood of exploitation, but combined with the high CVSS and the unauthenticated remote nature of the attack, the risk of exploitation in the wild remains high. The vulnerability is not yet listed in CISA’s KEV catalog, though that does not reduce the urgency of mitigating it. The attack vector is inferred to be remote over the network port that hosts the CGI endpoint, and the exploitation can be carried out by sending a crafted HTTP request containing the malicious CLI parameter.