CVE-2024-46658

Deeper analysis

Syrotech SY-GOPON-8OLT-L3 version 1.6.0_240629 contains an authenticated command injection vulnerability tracked as CVE-2024-46658 and assigned CWE-78. The flaw received a CVSS 3.1 score of 8.0, reflecting an adjacent-network attack vector, low attack complexity, and low required privileges that can result in full compromise of confidentiality, integrity, and availability.

An attacker who has already obtained authenticated access to the device can supply crafted input that is passed to an operating-system command, allowing arbitrary command execution on the underlying system. Successful exploitation therefore grants the attacker the ability to run commands with the privileges of the affected process, potentially leading to device takeover or lateral movement within the local network segment.

A publicly available proof-of-concept repository demonstrates the injection technique against the listed firmware version. No vendor advisory or official patch information is referenced in the available sources.

The EPSS score for this CVE reached a peak of 0.4497 before settling at a current value of 0.3259, indicating a noticeable increase in predicted exploitation interest after disclosure.