This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) within the OptiLink ONT1GEW GPON router firmware. Specifically, the web management interface fails to sanitize the target_addr parameter in the formTracert and formPing endpoints, allowing an authenticated attacker to inject arbitrary OS commands. These commands execute with root privileges, enabling remote code execution and full device compromise. The firmware versions affected include V2.1.11_X101 Build 1127.190306 and earlier. The vulnerability was publicly disclosed and exploitation evidence was observed in early 2025. No patch or vendor advisory detailing remediation is currently available.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. This leads to full compromise of the OptiLink ONT1GEW GPON router, potentially allowing control over the device and its network functions. The vulnerability is critical with a CVSS 4.0 score of 9.4. There is no indication of known exploits in the wild beyond the observed exploitation evidence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router’s web management interface to trusted administrators only and monitor for unauthorized access attempts. Avoid using affected firmware versions where possible.