PT-2021-23696 · Fiberhome · Fiberhome Onu Gpon An5506-04-F

Published 2021-12-16 · Updated 2021-12-22 · CVE-2021-42912

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FiberHome ONU GPON AN5506-04-F RP2617 (affected versions not specified)

Description The issue allows an attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool. This is achieved by bypassing the IP address field and concatenating OS commands with a semicolon.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-42912

Affected Products

Fiberhome Onu Gpon An5506-04-F

References · 8

• 🔥 https://medium.com/@windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2 · Exploit
• https://osv.dev/vulnerability/CVE-2021-42912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42912 · Security Note
• http://onu.com · Note
• https://t.me/cibsecurity/34151 · Telegram Post
• https://medium.com/%40windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2 · Note
• http://fiberhome.com · Note
• https://t.me/cvenotify/24764 · Telegram Post