CVE-2014-9118: Zhone zNID GPON 2426A web portal command injection via ipAddr

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote command execution with public exploit code and very high EPSS, though it requires portal access and low privileges.

What it is

The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 passes the ipAddr parameter to zhnping.cmd without sanitizing shell metacharacters, allowing command injection. An attacker who can reach the portal and authenticate can run arbitrary commands on the device, which is a network edge device often exposed to untrusted networks.

Impact

An attacker gains arbitrary command execution on the router/ONT with the privileges of the web portal process, enabling full compromise of the device and any traffic or credentials it handles.

Attack surface

Reached over the network through the web administrative portal's ping function (zhnping.cmd); the CVSS vector indicates low privileges are required and no user interaction. The portal must be reachable by the attacker, typically on the LAN or management interface.

Exploitation

Public exploit code exists (Exploit-DB 38453, Packet Storm, Full Disclosure) and EPSS is high at 0.53 (99th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade zNID 2426A firmware to S3.0.501 or later; this is the only complete fix.
• If patching is not possible, restrict access to the web administrative portal to a trusted management VLAN or specific admin hosts.
• Change default administrative credentials and enforce strong authentication on the portal.
• Disable or block remote management exposure of the portal on WAN-facing interfaces.
• Monitor vendor advisories for this product line since the record is old and support status is unclear.

Detection

• Inspect web server or device logs for requests to zhnping.cmd with shell metacharacters (;, |, &, $(), backticks) in the ipAddr parameter.
• Alert on unexpected outbound connections or processes spawned by the device's web service.
• Watch for authentication attempts against the administrative portal from unusual source addresses.
• Baseline normal ping/management traffic and flag anomalous command-like strings in HTTP parameters to the portal.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.