Vulnerability · Published Jun 26, 2025 · Assigned by VulnCheck

CVE-2025-34049OptiLink ONT1GEW GPON Remote Code Execution

Critical 9.4

In plain English

A critical-severity OS command injection in ONT1GEW GPON from OptiLink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)2.4%top 15.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web management interface fails to properly sanitize user input in the target_addr parameter of the formTracert and formPing administrative endpoints. An authenticated attacker can inject arbitrary operating system commands, which are executed with root privileges, leading to remote code execution. Successful exploitation enables full compromise of the device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

Affected products (as reported)

Vendor	Product	Versions
OptiLink	ONT1GEW GPON	0 – through V2.1.11_X101 Build 1127.190306

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.exploit-db.com/exploits/49955 exploit
https://optilinknetwork.com/ product
https://vulncheck.com/advisories/optilink-ont1gew-router-rce third-party-advisory
https://packetstorm.news/files/id/162993 exploit