CVE-2026-105110

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

State: Published
Severity: 9.3 Critical
Published: Oct 8, 2026
Updated: Oct 8, 2026
Reserved: Oct 3, 2026

Description

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L	TuranSec
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	TuranSec

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
InnboxIskratel

References

Exploit PoC and Technical Detailsexploitthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.