Iskratel Innbox GPON ONT: Unauthenticated OS command injection via login.xgi
Summary
The login.xgi web endpoint of Iskratel Innbox GPON ONT devices passes the CLI parameter directly to a system shell without authentication. An unauthenticated remote attacker on the network can execute arbitrary commands as root, read stored credentials, modify configuration and firmware, and use the device as a persistent foothold. A public proof of concept is available.
Affected
- Iskratel Innbox GPON ONT devices (CNA lists all versions as affected)
- Unconfirmed by vendor: PoC repository names G74 and M84 models with firmware Linux 3.18.21 (Aug 2023 build)
Fixed in
Unknown. No vendor advisory or fixed firmware version found.
Workaround
- Block access to the ONT web interface from WAN and untrusted networks (ports 80/443)
- Restrict management access to the ISP only
- Ask the ISP whether a firmware fix or device replacement is available
Exploitation
- Public proof of concept available on GitHub (exploit.py)
- CISA SSVC: exploitation status poc, automatable yes, technical impact total
- No evidence of exploitation in the wild found
- EPSS 0.02788
Our recommendation
- Identify all Innbox ONTs in the client estate and determine ownership (ISP or customer)
- Verify that the ONT management interface is not reachable from WAN or guest networks
- Ask the ISP for firmware status and a fix timeline
- Monitor web logs for requests to /login.xgi
- Monitor the Iskratel PSIRT for an advisory
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub: BlackHatExploitation/innbox_root (Proof of Concept) github.com
- VulDB: CVE-2026-105110 vuldb.com
- Strix: CVE-2026-105110 www.strix.ai
- PSIRT: CVE-2026-105110 psirt.com
- TheHackerWire: CVE-2026-105110 write-up www.thehackerwire.com
- Sploitus: exploit entry sploitus.com
- Vulners: CVE-2026-105110 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:01.
Original description (NVD)
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.