Read the docs
TI-2026-83955 Aliases CVE-2026-117082GHSA-m5fr-9mf3-m8g7

Authentication bypass in Sercomm AOT-4221SR UPnP framework

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA.

Summary

The Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device contains an authentication bypass. The flaw lets an attacker execute arbitrary SOAP requests via port 5555 without credentials. The exposed administrative, WAN, LAN and firewall services let attackers change routing tables and DNS servers and remove firewall rules.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.

Why it matters now

EPSS 0.00198 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Sercomm AOT-4221SR 4.6 Dual Band GPON ONU.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-117082
  2. 2026-11-02 Alias added: GHSA-m5fr-9mf3-m8g7

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences