Vulnerability · Published Oct 8, 2026 · Assigned by TuranSec
CVE-2026-105110Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
Critical 9.8
In plain English
A critical-severity OS command injection in Innbox from Iskratel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.0%top 12.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.
Affected products (as reported)
Weakness: CWE-78, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Exploit PoC and Technical Details exploit, third-party-advisory