9
CVE-2021-42912
- EPSS 10.01%
- Veröffentlicht 16.12.2021 17:15:07
- Zuletzt bearbeitet 09.07.2026 01:17:07
- Erkennungen
LoginFiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fiberhome ≫ An5506-01-a Firmware Version rp0509
Fiberhome ≫ An5506-01-b Firmware Version rp2610
Fiberhome ≫ An5506-02-b Firmware Version rp2520
Fiberhome ≫ An5506-02-b Firmware Version rp2521
Fiberhome ≫ An5506-02-b Firmware Version rp2603
Fiberhome ≫ An5506-04-b Firmware Version rp2510
Fiberhome ≫ An5506-04-f Firmware Version rp2617
Fiberhome ≫ Aan5506-04-g2g Firmware Version rp2560
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 10.01% | 0.951 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 9 | 8 | 10 |
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
https://medium.com/%40windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2
https://medium.com/@windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2