What’s Vulnerable › Vulnerabilities

CVE-2020-8958

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 45.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-15 · updated 2026-06-17
• Weakness: CWE-78

Description

Guangzhou 1GE ONU V2801RW 1.9.1-181203 through 2.9.0-181024 and V2804RGW 1.9.1-181203 through 2.9.0-181024 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the boaform/admin/formPing Dest IP Address field.

Affected products

• Gpononu 1Ge+3Fe+Wifi Onu V2804Rgw Firmware: from 1.9.1-181203 through 2.9.0-181024
• Gpononu 1Ge Router Wifi Onu V2801Rw Firmware: from 1.9.1-181203 through 2.9.0-181024

References

• https://github.com/qurbat/gpon
• https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html
• https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html
• https://www.karansaini.com/os-command-injection-v-sol/
• https://github.com/qurbat/gpon
• https://www.gpononu.com/dual-mode-onu/1GE-Router-WiFi-ONU.html
• https://www.gpononu.com/gpon-ont/4ge-epon-onu-v2804ew.html
• https://www.karansaini.com/os-command-injection-v-sol/

Get alerted when CVE-2020-8958 or the next vulnerability affects your stack