CVE-2026-105110: critical vulnerability in Iskratel Innbox
Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.3epss 3.0%
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
Iskratel · Innboxpublic PoCs found — 1
cve_referencegithub.com/BlackHatExploitation/innbox_rootunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.