---
id: "CVE-2026-117082"
kind: "vulnerability"
aliases: ["CVE-2026-117082"]
title: "Sercomm AOT-4221SR router: UPnP flaw lets attackers change admin settings without login"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOT-4221SR", "fixed": [], "affected": "4.6 (other firmware unknown)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aot-4221sr", "gpon-onu", "infrastructure", "isp-gateway", "sercomm", "upnp"]
not_affected_if: ["unknown"]
published_at: "2026-11-02T20:17:33+00:00"
first_seen_at: "2026-11-02T20:35:26+00:00"
updated_at: "2026-11-02T20:41:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117082", "first_seen_at": "2026-11-02T20:35:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T20:41:29+00:00"}]
---

# Sercomm AOT-4221SR router: UPnP flaw lets attackers change admin settings without login

The Sercomm AOT-4221SR 4.6 dual-band GPON ONU has a UPnP framework flaw that accepts arbitrary SOAP requests on port 5555 without credentials. An attacker can reach 15 administrative, WAN, LAN and firewall services, change routing tables and DNS servers, and remove firewall rules.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOT-4221SR affected 4.6 (other firmware unknown) fixed ?

## How to check

- Confirm the device is a Sercomm AOT-4221SR (usually an ISP-supplied GPON ONU) running firmware 4.6.
- From outside your network, test whether TCP 5555 answers; from the LAN, check the same. The CVE does not say whether 5555 is open on WAN by default.
- No vendor fix is published as of 2026-11-02; ask your ISP or Sercomm for firmware and block 5555 at an upstream firewall if you can.

## Timeline

- 2026-11-02T20:35:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117082
- 2026-11-02T20:41:29+00:00 analyst — Only the CVE record (NVD/OpenCVE mirror) exists; no Sercomm advisory, fix, PoC or exploitation found. Firmware scope beyond 4.6 and WAN exposure of 5555 by default not stated anywhere. Nothing verified.

## Documents

- [describes] OpenCVE: CVE-2026-117082 (mirror of NVD record; no remediation listed) https://app.opencve.io/cve/CVE-2026-117082

## From the sources

An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_