An OS command injection vulnerability in LITE-ON FF-RFI079I4 and FF-RFI078I4 devices allows authenticated users to achieve full system compromise via the NETCONF interface.

This is an OS command injection flaw (CWE-78) occurring within the M-Plane (NETCONF) management interface. The vulnerability requires the attacker to possess low-level authenticated access to the device to inject and execute arbitrary system commands.

The ability to execute arbitrary OS commands on network infrastructure components poses a severe risk to organizational security. Successful exploitation could lead to total system takeover, unauthorized access to sensitive network traffic, or the permanent disruption of critical telecommunications services. With a CVSS score of 8.7, this high-severity vulnerability necessitates immediate prioritization for patching to prevent unauthorized administrative control.

Immediate Action: Update all affected LITE-ON FF-RFI079I4 and FF-RFI078I4 units to firmware version 02.01.15 or later immediately.

Proactive Monitoring: Review NETCONF access logs for unusual command patterns or unauthorized login attempts originating from unexpected IP addresses.

Compensating Controls: Restrict access to the M-Plane (NETCONF) interface to known, trusted management workstations via network ACLs or firewalls to limit the attack surface.

Public Exploit Available: exploit_available (false)

Given the potential for remote code execution and the critical nature of the affected hardware, security teams must treat this vulnerability as a priority. Administrators should verify the current firmware version across all deployed units and apply the 02.01.15 update as the primary method of remediation. Failure to patch these devices leaves infrastructure vulnerable to attackers who have obtained valid user credentials.