CVE-2026-80217: FF-RFI079I4/FF-RFI078I4 RCE Vulnerability

CVE-2026-80217 Overview

CVE-2026-80217 is a hidden functionality vulnerability affecting Lite-On FlexFi FF-RFI079I4 and FF-RFI078I4 devices. An authenticated user who can log in via SSH and reach the enable mode can invoke undocumented functionality to execute arbitrary operating system commands. The flaw is classified under CWE-912: Hidden Functionality and is exploitable over the network. Successful exploitation yields full command execution on the underlying OS, compromising the confidentiality, integrity, and availability of the device.

Critical Impact

An attacker with SSH credentials and enable-mode access can execute arbitrary OS commands, effectively taking full control of the affected FlexFi product.

Affected Products

• Lite-On FlexFi FF-RFI079I4
• Lite-On FlexFi FF-RFI078I4
• Refer to the Lite-On Security Page for vendor-confirmed firmware versions

Discovery Timeline

• 2026-09-15 - CVE-2026-80217 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-80217

Vulnerability Analysis

The vulnerability stems from hidden functionality embedded in the FlexFi device firmware. This undocumented feature is reachable from the CLI enable mode following an authenticated SSH session. Once invoked, it allows the operator to pass input that the device executes as an OS-level command.

Because command execution occurs in the context of the device operating system, an attacker can read sensitive configuration, alter routing or radio parameters, install persistence, or pivot into adjacent network segments. The attacker must first authenticate over SSH and then transition to enable mode, so exploitation requires valid low-privilege credentials rather than a fully unauthenticated network position.

Root Cause

The root cause is a hidden or undocumented command path shipped in the firmware. Under [CWE-912], such functionality bypasses the vendor-published administrative surface and often lacks the input validation and authorization checks that would apply to documented CLI commands. In this case, the hidden path provides a direct bridge from CLI input to OS command execution.

Attack Vector

Exploitation follows a straightforward sequence. The attacker opens an SSH session to the device using valid credentials, enters privileged enable mode, and then invokes the hidden functionality to run arbitrary OS commands. The attack vector is network-based, requires low privileges, and does not require user interaction. Refer to JVN Vulnerability Report JVN02049764 for coordinated disclosure details.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA KEV catalog.

Detection Methods for CVE-2026-80217

Indicators of Compromise

• Unexpected SSH logins to FlexFi FF-RFI079I4 or FF-RFI078I4 devices, particularly from non-administrative source addresses or outside change windows.
• Enable-mode transitions followed by CLI activity that does not match documented operator workflows.
• Outbound network connections originating from the device to unknown hosts, indicating possible post-exploitation command execution.

Detection Strategies

• Enable verbose SSH and CLI command auditing on affected devices and forward the logs to a centralized log analytics or SIEM platform.
• Baseline the set of legitimate CLI commands issued in enable mode and alert on deviations, especially commands that resemble shell syntax.
• Correlate authentication events with subsequent network egress from the device to identify anomalous command execution patterns.

Monitoring Recommendations

• Restrict SSH management access to a dedicated administrative VLAN and monitor that segment for unusual session sources or durations.
• Track privileged account use on FlexFi devices and alert on repeated enable-mode escalations from a single session.
• Review vendor advisories on the Lite-On Security Page for updated indicators or firmware release notes.

How to Mitigate CVE-2026-80217

Immediate Actions Required

• Apply the firmware update published by Lite-On for FF-RFI079I4 and FF-RFI078I4 as soon as it is available on the Lite-On Security Page.
• Rotate all SSH credentials and enable-mode passwords on affected devices, and remove any shared or default accounts.
• Restrict SSH access to a small allowlist of administrative source IP addresses using network access control lists.

Patch Information

Lite-On has published advisory information on the Lite-On Security Page. Coordinated disclosure details are available in JVN Vulnerability Report JVN02049764. Administrators should upgrade to the fixed firmware version listed by the vendor and verify the running image after upgrade.

Workarounds

• Disable SSH management access on devices where it is not operationally required.
• Enforce strong, unique credentials and multi-factor authentication on any jump host used to reach FlexFi devices.
• Limit the number of accounts permitted to reach enable mode and audit their use on a regular cadence.

# Configuration example: restrict SSH management access with an ACL
# (adapt to the FlexFi CLI syntax documented by Lite-On)
configure terminal
 ip access-list standard MGMT-SSH
  permit host 10.10.0.5
  permit host 10.10.0.6
  deny any log
 line vty 0 4
  access-class MGMT-SSH in
  transport input ssh
end
write memory