OS Command Injection Vulnerability in Calix GigaCenter ONT
CVE-2025-54084

8.5HIGH

Key Information:

Vendor

Calix

Status
Gigacenter Ont
Vendor
CVE Published:
9 September 2025

What is CVE-2025-54084?

An OS Command Injection vulnerability exists in Calix GigaCenter ONT devices, affecting models 844E, 844G, 844GE, and 854GE. This flaw allows authenticated attackers with super user credentials to execute arbitrary operating system commands due to improper input validation. If exploited, it could lead to full system compromise, posing serious risks to network integrity and data security. Ensuring proper validation and restricting access to sensitive areas can mitigate this vulnerability.

Affected Version(s)

GigaCenter ONT 844E

GigaCenter ONT 844G

GigaCenter ONT 844GE

References

https://fluidattacks.com/advisories/bacalao
third-party-advisory
https://www.calix.com
productrelated

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54084 : OS Command Injection Vulnerability in Calix GigaCenter ONT