9

CVE-2021-42912

FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fiberhome ≫ An5506-01-a Firmware Versionrp0509
   Fiberhome ≫ An5506-01-a Version-
Fiberhome ≫ An5506-01-b Firmware Versionrp2610
   Fiberhome ≫ An5506-01-b Version-
Fiberhome ≫ An5506-02-b Firmware Versionrp2520
   Fiberhome ≫ An5506-02-b Version-
Fiberhome ≫ An5506-02-b Firmware Versionrp2521
   Fiberhome ≫ An5506-02-b Version-
Fiberhome ≫ An5506-02-b Firmware Versionrp2603
   Fiberhome ≫ An5506-02-b Version-
Fiberhome ≫ An5506-04-b Firmware Versionrp2510
   Fiberhome ≫ An5506-04-b Version-
Fiberhome ≫ An5506-04-f Firmware Versionrp2617
   Fiberhome ≫ An5506-04-f Version-
Fiberhome ≫ Aan5506-04-g2g Firmware Versionrp2560
   Fiberhome ≫ An5506-04-g2g Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.273
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://onu.com
Not Applicable