CVE-2021-42912

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-16 · updated 2026-07-09
Weakness: CWE-78

Description

FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.

Affected products

FiberHome Aan5506-04-G2G Firmware: rp2560
FiberHome AN5506-01A ONU GPON: rp0509
FiberHome An5506-01-B Firmware: rp2610
FiberHome An5506-02-B Firmware: rp2520, rp2521, rp2603
FiberHome An5506-04-B Firmware: rp2510
FiberHome An5506-04-F Firmware: rp2617

References

https://medium.com/@windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2
https://medium.com/%40windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2

Get alerted when CVE-2021-42912 or the next vulnerability affects your stack