CVE-2026-80217

A hidden functionality flaw (CWE-912) in the FF-RFI079I4 and FF-RFI078I4 devices allows a user who can log in over SSH and reach the device's enable mode to execute arbitrary operating-system commands. This is not an unauthenticated remote attack — exploitation requires valid SSH credentials and access to the privileged enable mode, so it abuses undocumented functionality reachable from the authenticated CLI rather than a memory-safety bug. A successful attacker gains the ability to run any OS command on the device, with high impact on its confidentiality, integrity, and availability (CVSS v4.0 8.7, high, PR:L). Any organization running either model — especially with SSH reachable from untrusted networks or with shared/default administrative credentials — is affected. No public proof of concept is known, the issue is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

What to do: Apply the vendor's fixed firmware for FF-RFI079I4 and FF-RFI078I4 as described in the JPCERT advisory (check the vendor's support page for the specific update). Until patched, disable SSH if not needed or restrict it to trusted management networks, and rotate both login and enable-mode credentials while eliminating shared or default accounts. Review device logs for unexpected enable-mode sessions or unusual CLI activity.