CVE-2014-9118

Name of the Vulnerable Software and Affected Versions Zhone zNID GPON 2426A versions prior to S3.0.501

Description The issue concerns the web administrative portal, where remote attackers can execute arbitrary commands. This is achieved by using shell metacharacters in the ipAddr parameter to the "zhnping.cmd" endpoint.

Recommendations For versions prior to S3.0.501, update to version S3.0.501 or later to resolve the issue. As a temporary workaround, consider restricting access to the "zhnping.cmd" endpoint to minimize the risk of exploitation. Avoid using the ipAddr parameter in the affected endpoint until the issue is resolved.