OptiLink ONT1GEW GPON Remote Code Execution

published 2025-06-26 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19206

cvss: 9.4; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web management interface fails to properly sanitize user input in the target_addr parameter of the formTracert and formPing administrative endpoints. An authenticated attacker can inject arbitrary operating system commands, which are executed with root privileges, leading to remote code execution. Successful exploitation enables full compromise of the device. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 16 mo ago (2025-06-26)

Exploit prediction

2.43% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

exploit-db.com https://www.exploit-db.com/exploits/49955 referenced PoC, tagged "exploit" by a source, unverified
packetstorm.news https://packetstorm.news/files/id/162993 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

OptiLink ONT1GEW GPON

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/49955
exploit
packetstorm.news /files/id/162993
exploit
optilinknetwork.com /
product
vulncheck.com /advisories/optilink-ont1gew-router-rce
third-party-advisory

Sources

CVE List CVE-2025-34049
NVD CVE-2025-34049

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary