CVE-2026-117082
Received Received - Intake

Authentication Bypass in Sercomm AOT-4221SR GPON ONU

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MITRE

Description
An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-117082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in the UPnP framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device. It allows attackers to send arbitrary SOAP requests via port 5555 without credentials. This exposes 15 administrative, WAN, LAN, and firewall services, enabling unauthorized network modifications.

Detection Guidance

To detect this vulnerability, scan for open port 5555 on your Sercomm AOT-4221SR device using tools like nmap. Run: nmap -p 5555 <device_IP>. If port 5555 is open, test for unauthenticated SOAP requests by sending a simple HTTP request to the UPnP service.

Impact Analysis

Attackers can exploit this flaw to modify core routing tables, change DNS servers, remove firewall rules, and fully compromise the network. This could lead to unauthorized access, data breaches, or complete network takeover if exploited within the local network.

Mitigation Strategies

Immediately disable UPnP on the device if possible. Block external and internal access to port 5555 using firewall rules. Update to the latest firmware if an official patch is available. Isolate the device from critical network segments until mitigation is confirmed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...