CVE-2020-8958: RCE on Guangzhou ONU via Ping

CVE-2020-8958 is an OS command injection vulnerability affecting Guangzhou ONU (Optical Network Unit) devices series V2801RW and V2804RGW. The injection occurs via shell metacharacters in the Dest IP Address field of the web console boaform/admin/formPing. A remote attacker can execute arbitrary commands with device privileges, fully compromising the access networks that depend on them.

The vulnerability has CVSS 7.2 (HIGH tier). It was officially described on July 15, 2020 and affects all versions from 1.9.1-181203 through 2.9.0-181024 of both models. A recent GitHub signal (October 30, 2026) indicates the existence of public repositories claiming to contain exploits, showing the threat remains current despite 6 years since discovery.

In defense: identify which Guangzhou device versions are in production in your networks; strictly limit access to the web admin console (the flaw's entry point) to trusted IP addresses; monitor access logs to boaform/admin for unusual attempts or anomalous Ping parameters; immediately contact Guangzhou vendor to verify patch availability beyond version 2.9.0-181024. If updates are unavailable, consider isolating these devices from critical networks or replacing them.