CVE-2026-45431: Command Injection Vulnerability in GX Earth ONT Models

Synopsis

A command injection vulnerability affects the web management interface of GX Earth ONT models (GX Earth 2022 and GX Earth 1010). The flaw is reachable over the network by any authenticated user, meaning a low-privilege account is sufficient to trigger it; no special conditions or victim interaction are required. Successful exploitation gives the attacker the ability to run arbitrary OS commands on the device with root privileges, resulting in full remote code execution. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available the moment upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web management interface over the network; the CVSS vector specifies AV:N, meaning the vulnerable surface is exposed remotely.

• AuthenticationRequired

  A valid account on the web management interface is needed, but any low-privilege account is sufficient; the CVSS vector specifies PR:L.

• Victim interactionNot required

  No action from another user is needed; the attacker can trigger the vulnerability entirely on their own, as the CVSS vector specifies UI:N.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• The attacker executes arbitrary OS commands on the targeted ONT device with root privileges, gaining full control of the host operating system.
• All data accessible on the device, including configuration files, stored credentials, and network traffic passing through the ONT, can be read.
• The attacker can modify device configuration, alter routing behavior, or install persistent backdoors on the device.
• The attacker can render the device inoperable, disrupting network connectivity for any downstream users or services relying on it.