CVE-2026-117082 in AOT-4221SR
Summary
by MITRE • 11/02/2026
An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The Universal Plug and Play framework within the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device contains a critical authentication bypass vulnerability that fundamentally undermines the security architecture of the network access point. This flaw specifically affects the Simple Object Access Protocol interface exposed on port 5555, allowing unauthenticated actors to interact directly with the device's management services. The absence of required credentials for these SOAP requests represents a severe failure in access control mechanisms, effectively rendering the administrative interfaces publicly accessible without any form of verification or token validation. This architectural weakness allows external entities to bypass standard security gateways and gain direct programmatic access to sensitive system functions that should be restricted to authorized administrators only.
The operational impact of this vulnerability is extensive and potentially catastrophic for network integrity. By exploiting this flaw, an attacker can execute arbitrary SOAP requests against fifteen distinct administrative services covering WAN configuration, LAN settings, and firewall rules. This level of access enables the modification of core routing tables, which can be used to redirect traffic through malicious nodes or facilitate man-in-the-middle attacks. Furthermore, attackers can alter DNS server configurations to perform domain hijacking or phishing campaigns by directing users to fraudulent websites that mimic legitimate services. The ability to remove firewall rules effectively strips the device of its primary defense mechanism against external threats, leaving all connected devices exposed to direct internet-based attacks and unauthorized access attempts.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify the identity of users attempting to gain access to resources or perform actions. It also relates closely to CWE-613 Insufficient Session Expiration when considering how long these unauthenticated sessions remain active and exploitable. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps directly to T1078 Valid Accounts if the attacker leverages default credentials or bypasses them entirely, falling under Initial Access techniques that allow for persistent footholds within a network environment. The ability to modify routing tables and firewall rules further extends into lateral movement and defense evasion tactics, enabling long-term unauthorized control over the infrastructure.
Mitigation strategies must prioritize immediate isolation of vulnerable devices from untrusted networks until patches are applied. Network administrators should disable UPnP services entirely if they are not strictly required for legitimate network operations, as this protocol is frequently exploited due to its design assumptions about trusted local environments. If UPnP remains necessary, strict access control lists should be implemented on port 5555 to restrict SOAP request origins to known internal IP addresses only. Additionally, changing default administrative credentials and enforcing strong password policies can reduce the attack surface for related authentication flaws. Regular firmware updates from Sercomm are essential to address these underlying code defects, and continuous monitoring of network traffic for anomalous SOAP requests on management ports can help detect exploitation attempts in real time before significant damage occurs.