CVE-2026-117082

Authentication Bypass in Sercomm AOT-4221SR UPnP Allows Remote SOAP Control

View on CVE.org
Published Nov 2, 2026 CVSS n/a EPSS < 1% KEV · Not listed
Description
An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Sercomm
Sercomm aot-4221sr
Vendors & Products Sercomm
Sercomm aot-4221sr
Type Values Removed Values Added
Title Authentication Bypass in Sercomm AOT-4221SR UPnP Allows Remote SOAP Control
Weaknesses CWE-284
CWE-287
Type Values Removed Values Added
Description An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Nov 2, 2026, 7:24 PM
Reserved
Oct 27, 2026, 12:00 AM

View source JSON

No data.

Status
Deferred
Published
Nov 2, 2026, 8:17 PM
Modified
Nov 3, 2026, 4:30 PM

View source JSON

No data.

Updated
Nov 3, 2026, 4:29 PM

JSON