CVE-2026-105110: Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
Published Oct 8, 2026
·Updated
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
Affected Software
1 affected component
Iskratel Innbox GPON ONT
Event History
Oct 8, 2026
CVE Published
via MITRE·09:00 AM
Data Sourced
via MITRE·09:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated remote attacker can exploit the vulnerable login.xgi CGI endpoint. The attack requires no privileges or user interaction.
2
What level of access could exploitation provide?
Successful exploitation allows arbitrary operating-system commands to be executed as root on the affected device. This can compromise confidentiality, integrity, and availability.