{"id":"CVE-2026-117082","kind":"vulnerability","aliases":["CVE-2026-117082"],"related":[],"title":"Sercomm AOT-4221SR router: UPnP flaw lets attackers change admin settings without login","description":"An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.","summary":"The Sercomm AOT-4221SR 4.6 dual-band GPON ONU has a UPnP framework flaw that accepts arbitrary SOAP requests on port 5555 without credentials. An attacker can reach 15 administrative, WAN, LAN and firewall services, change routing tables and DNS servers, and remove firewall rules.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AOT-4221SR","fixed":[],"affected":"4.6 (other firmware unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["aot-4221sr","gpon-onu","infrastructure","isp-gateway","sercomm","upnp"],"not_affected_if":["unknown"],"how_to_check":"- Confirm the device is a Sercomm AOT-4221SR (usually an ISP-supplied GPON ONU) running firmware 4.6.\n- From outside your network, test whether TCP 5555 answers; from the LAN, check the same. The CVE does not say whether 5555 is open on WAN by default.\n- No vendor fix is published as of 2026-11-02; ask your ISP or Sercomm for firmware and block 5555 at an upstream firewall if you can.","fix":null,"status":"open","published_at":"2026-11-02T20:17:33+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","triaged_at":"2026-11-02T20:40:55+00:00","updated_at":"2026-11-02T20:41:29+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:40:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Sercomm AOT-4221SR router: UPnP flaw lets attackers change admin settings without login","impact":"high","summary":"The Sercomm AOT-4221SR 4.6 dual-band GPON ONU has a UPnP framework flaw that accepts arbitrary SOAP requests on port 5555 without credentials. An attacker can reach 15 administrative, WAN, LAN and firewall services, change routing tables and DNS servers, and remove firewall rules.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sercomm","aot-4221sr","gpon-onu","upnp","isp-gateway"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reconfigures the router, changes DNS and removes firewall rules","analyst_note":"Confirm the affected firmware range, whether port 5555 is exposed on WAN by default, and whether the vendor has issued a fix; check the NVD entry and Sercomm advisories.","how_to_check":"- Check whether the device is a Sercomm AOT-4221SR running firmware 4.6 (unknown whether the sources list a firmware version scope beyond 4.6)\n- Check whether TCP port `5555` is reachable from outside the device's own network\n- unknown whether the sources give a configuration command or setting to confirm UPnP exposure","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Owners or operators of the Sercomm AOT-4221SR 4.6 GPON ONU, typically an ISP-supplied fiber gateway. The flaw is reachable through the device's UPnP service on port 5555, so exposure depends on whether that port can be reached from the network the device serves or from the internet. unknown whether the sources state any configuration that removes the exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4195,"output_tokens":694,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the affected firmware range, whether port 5555 is exposed on WAN by default, and whether the vendor has issued a fix; check the NVD entry and Sercomm advisories.","search":"'-117082':17A,20A '-2026':16A,19A '15':66B,121C '4.6':41B,101C '4221sr':4A,23A,26B,40B,100C '5555':59B,117C 'accept':53B 'admin':11A 'administr':67B,122C 'allow':107C 'alter':138C 'aot':3A,22A,25B,39B,99C 'aot-4221sr':2A,21A,24B,38B,98C 'arbitrari':54B,112C 'attack':9A,63B,109C,132C 'authent':84C 'band':44B,103C 'bypass':85C 'chang':10A,73B 'complet':145C 'compromis':146C 'core':135C 'credenti':61B,130C 'cve':15A,18A 'devic':106C 'dns':77B,139C 'dual':43B,102C 'dual-band':42B 'enabl':131C 'execut':111C 'expos':120C 'firewal':71B,81B,126C,142C 'flaw':7A,51B,119C 'framework':50B,94C 'gateway':33B 'gpon':28B,45B,104C 'gpon-onu':27B 'infrastructur':30B 'isp':32B 'isp-gateway':31B 'lan':69B,124C 'let':8A 'login':14A 'modifi':134C 'network':148C 'onu':29B,46B,105C 'play':92C 'plug':90C 'port':58B,116C 'reach':65B 'remov':80B,141C 'request':56B,114C 'requir':129C 'rout':74B,136C 'router':5A 'rule':82B,143C 'sercomm':1A,34B,37B,97C 'server':78B,140C 'servic':72B,127C 'set':12A 'soap':55B,113C 'tabl':75B,137C 'univers':89C 'upnp':6A,35B,49B,93C 'via':115C 'vulner':86C 'wan':68B,123C 'without':13A,60B,128C","nicknames":[],"mitigations":[],"who_affected":"Operators of the Sercomm AOT-4221SR 4.6 GPON ONU, usually an ISP-supplied fiber gateway. The CVE says that UPnP SOAP requests on port 5555 are accepted without credentials, so anyone who can reach that port can change routing, DNS and firewall settings. Whether the port is reachable from the internet by default is not stated. Other firmware versions and other Sercomm models are not confirmed either way.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["aot4221sr"],"ptokens":["4221sr","aot"],"labels":["aot4221sr","gpononu","high","infrastructure","ispgateway","sercomm","upnp"],"first_public_at":"2026-11-02T20:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117082","severity":null,"published_at":"2026-11-02T20:17:33+00:00","modified_at":"2026-11-02T20:17:33+00:00","first_seen_at":"2026-11-02T20:35:26+00:00","fetched_at":"2026-11-02T20:35:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117082:1428","url":null,"severity":null,"published_at":"2026-11-02T20:41:29+00:00","modified_at":"2026-11-02T20:41:29+00:00","first_seen_at":"2026-11-02T20:41:29+00:00","fetched_at":"2026-11-02T20:41:29+00:00","note":"Only the CVE record (NVD/OpenCVE mirror) exists; no Sercomm advisory, fix, PoC or exploitation found. Firmware scope beyond 4.6 and WAN exposure of 5555 by default not stated anywhere. Nothing verified."}],"documents":[{"id":53800,"url":"https://app.opencve.io/cve/CVE-2026-117082","title":"OpenCVE: CVE-2026-117082 (mirror of NVD record; no remediation listed)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}