This vulnerability (CVE-2026-45431) involves improper neutralization of special elements used in OS commands (CWE-78) within GX INDIA's GX Earth 2022 ONT models. Specifically, multiple diagnostic functions in the web management interface do not properly sanitize user-supplied input, allowing an authenticated remote attacker to inject and execute arbitrary OS commands. Successful exploitation results in remote code execution with root privileges, posing a significant risk to device integrity and network security. The affected versions are E2022 - 3.1.2A, 3.1.5AV, and 1.1ASL. The CVSS v4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the date of this report.

Exploitation of this vulnerability allows an authenticated remote attacker to execute arbitrary OS commands with root privileges on the targeted GX Earth 2022 device. This can lead to full compromise of the device, including unauthorized control, data manipulation, and disruption of device operations. The high CVSS score (8.7) reflects the critical nature of the impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web management interface to trusted administrators only and enforce strong authentication controls. Monitor for unusual activity on affected devices. Do not expose the management interface to untrusted networks. Follow GX INDIA's official channels for updates on patches or mitigations.