CVE-2025-34049

OptiLink ONT1GEW GPON Remote Code Execution

State: Published
Severity: 9.4 Critical
Published: Jun 26, 2025
Updated: Apr 7, 2026
Reserved: Apr 15, 2025

Description

An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web management interface fails to properly sanitize user input in the target_addr parameter of the formTracert and formPing administrative endpoints. An authenticated attacker can inject arbitrary operating system commands, which are executed with root privileges, leading to remote code execution. Successful exploitation enables full compromise of the device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	VulnCheck

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
ONT1GEW GPONOptiLink	V2.1.11_X101 Build 1127.190306 and earlierAffected

References

https://www.exploit-db.com/exploits/49955exploit
https://optilinknetwork.com/product
https://vulncheck.com/advisories/optilink-ont1gew-router-rcethird-party-advisory
https://packetstorm.news/files/id/162993exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.