by Kastro
Paper/Archive/CVE-2026-105110

CVE-2026-105110

Iskratel Innbox — Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.5.875 × 2017.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

Affected

ProductAffectedFixed inSource
Innboxsee advisory–CNA

Scores by source

TuranSec (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TuranSec (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/BlackHatExploitation/innbox_root