CVE-2020-8958: GPON ONU web interface OS command injection via ping field

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityNetwork-reachable OS command injection with public exploit code and very high EPSS, though it requires administrative credentials and is not in KEV.

What it is

The Guangzhou 1GE ONU V2801RW and V2804RGW devices pass the Dest IP Address field of boaform/admin/formPing to the shell without sanitising metacharacters, allowing OS command injection. An attacker who can reach the management interface and authenticate can run arbitrary commands on the device.

Impact

Successful exploitation gives the attacker arbitrary OS command execution with the privileges of the web service, enabling full compromise of the ONU and any traffic or credentials it handles.

Attack surface

Reachable over the network through the device's HTTP management interface (AV:N) at the boaform/admin/formPing endpoint. The CVSS vector requires high privileges (PR:H), so valid administrative credentials are needed; no user interaction is required.

Exploitation

Public exploit code is referenced (GitHub and a third-party advisory tagged Exploit), and EPSS is 0.46642 (98.8th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded.

What to do

• Apply the vendor firmware update for V2801RW and V2804RGW if one is available; the record does not name a fixed version, so confirm with the vendor.
• If no patch exists, restrict management access to a trusted management VLAN or block the HTTP admin interface from untrusted networks.
• Change default administrative credentials and enforce strong, unique passwords to satisfy the PR:H precondition.
• Disable or restrict the ping/diagnostic functionality in the web UI if the device permits it.
• Monitor vendor advisories for these ONU models and replace end-of-support units.

Detection

• Inspect HTTP requests to /boaform/admin/formPing for shell metacharacters (;, |, &, $(), backticks) in the Dest IP Address parameter.
• Alert on unexpected outbound connections or processes spawned by the ONU web service following ping requests.
• Review device and upstream logs for command execution artifacts or unusual traffic originating from ONU management addresses.
• Baseline normal admin activity and flag formPing requests from IPs outside the management network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.