Anmol Bakshi

**Name of the Vulnerable Software and Affected Versions** GX Earth ONT (affected versions not specified) **Description** Improper handling of user-supplied input in multiple diagnostic functions within the web management interface allows an authenticated remote attacker to inject and execute arbitrary OS commands. Successful exploitation enables remote code execution with root privileges on the targeted device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GX Earth ONT (affected versions not specified) **Description** The web management interface transmits user credentials in plaintext over HTTP. A remote attacker can intercept network traffic to obtain sensitive authentication information, potentially leading to unauthorized access to the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GX Earth 2022 ONT models **Description** An issue exists due to a hardcoded RSA private key within the device firmware. A remote attacker could extract this cryptographic private key to decrypt HTTPS traffic and perform Man-in-the-Middle (MITM) attacks, which involve an attacker secretly relaying and possibly altering the communications between two parties who believe they are directly communicating with each other. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.