CVE-2026-105110: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Iskratel Innbox

This vulnerability (CVE-2026-105110) affects Iskratel Innbox GPON ONT devices. The flaw exists in the login.xgi CGI endpoint where improper neutralization of special elements in the CLI parameter allows an unauthenticated remote attacker to perform OS command injection. Successful exploitation results in arbitrary command execution as root, compromising the device fully. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can execute arbitrary commands on the affected device with root privileges, leading to full system compromise. This can result in complete loss of confidentiality, integrity, and availability of the device and potentially the network it serves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict network access to the affected devices and monitor for suspicious activity targeting the login.xgi endpoint.