High severity8.8NVD Advisory· Published Oct 17, 2017· Updated May 13, 2026

CVE-2014-9118

Description

The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.

Affected products

Dasanzhone/Znid 2426a Firmware
cpe:2.3:o:dasanzhone:znid_2426a_firmware:-:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2015/Oct/57nvdExploitMailing ListThird Party Advisory
www.exploit-db.com/exploits/38453/nvdExploitThird Party AdvisoryVDB Entry
www.securityfocus.com/archive/1/536663/100/0/threadednvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.042
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000