CVE-2014-9118

High

Published: 17/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The web administrative portal in Zhone zNID GPON 2426A before version S3.0.501 is vulnerable to remote attacks that allow arbitrary command execution via shell metacharacters in the ipAddr parameter to zhnping.cmd.

Risk Assessment

An attacker could remotely access the system and execute unauthorized commands, potentially leading to serious security breaches.

Recommendation

It is recommended to update the device to version S3.0.501 or later to mitigate this vulnerability.

Other vulnerabilities in Zhone zNID GPON 2426A

CVE-2014-8357High
In the web administrative portal of Zhone zNID GPON 2426A before version S3.0.501, a session key is placed in a URL, allowing remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.

Original NVD description (English source)

The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS