CVE-2025-54084

OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.

CVSS

No CVSS.

References

Link	Resource
https://fluidattacks.com/advisories/bacalao
https://revers3everything.com/calix-case-five-0-days-five-cves/
https://www.calix.com
https://fluidattacks.com/advisories/bacalao

Configurations

No configuration.

History

12 Sep 2025, 14:15

Type	Values Removed	Values Added
References		() https://revers3everything.com/calix-case-five-0-days-five-cves/ -

10 Sep 2025, 16:15

Type	Values Removed	Values Added
References	~~() https://fluidattacks.com/advisories/bacalao -~~	() https://fluidattacks.com/advisories/bacalao -

09 Sep 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-09-09 21:15

Updated : 2025-09-12 14:15

NVD link : CVE-2025-54084

Mitre link : CVE-2025-54084

CVE.ORG link : CVE-2025-54084

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-54084", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "help@fluidattacks.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-09-09T21:15:36.657", "references": [{"url": "https://fluidattacks.com/advisories/bacalao", "source": "help@fluidattacks.com"}, {"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/", "source": "help@fluidattacks.com"}, {"url": "https://www.calix.com", "source": "help@fluidattacks.com"}, {"url": "https://fluidattacks.com/advisories/bacalao", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "help@fluidattacks.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules)\u00a0allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."}], "lastModified": "2025-09-12T14:15:41.363", "sourceIdentifier": "help@fluidattacks.com"}