CVE-2026-105110

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter PUBLISHED

Description (CNA)

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

Affected (CNA)

Vendor / product	Versions
Iskratel / Innbox	affected

CWE

CWE-78, CWE-306

References

https://github.com/BlackHatExploitation/innbox_root

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.