CVE-2021-42912

HighCVSS 8.8

Published: 16/12/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

10.87%

95th percentile - higher than 95% of all known CVEs

Summary

The vulnerability in FiberHome ONU GPON AN5506-04-F RP2617 allows OS command injection. An authenticated attacker can send commands as root via the ping diagnostic tool by bypassing the IP address field and concatenating commands with a semicolon.

Risk Assessment

The risk involves potential full device compromise with root privileges, leading to network integrity breaches and access to sensitive data.

Recommendation

Immediately update the device firmware to the latest version and restrict management interface access to trusted IP addresses only.

Original NVD description (English source)

FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.