CVE-2026-45431

Command Injection Vulnerability in GX Earth ONT Models

State: Published
Severity: 8.7 High
Published: Jun 4, 2026
Updated: Jun 4, 2026
Reserved: May 12, 2026

Description

This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic functions in its web management interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary and executing OS commands on the targeted device.

Successful exploitation of this vulnerability could allow the attacker to perform remote code execution with root privileges on the targeted device.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CERT-In

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')

Affected Products

Product	Versions
GX Earth 2022GX INDIA	version E2022 - 3.1.2AAffected version E2022 - 3.1.5AVAffected version E2022 - 1.1ASLAffected
GX Earth 1010GX INDIA	version E1010-1.1ASLAffected

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0288third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.