OS Command Injection Vulnerability in FiberHome ONU GPON AN5506-04-F

CVE-2021-42912

What is CVE-2021-42912?

The ONU GPON AN5506-04-F RP2617 by FiberHome is susceptible to an OS command injection vulnerability. When an attacker gains access, they can exploit the ping diagnostic tool to execute arbitrary commands at the root level. This security flaw occurs as a result of the improper validation of user input, allowing attackers to manipulate the command execution process by bypassing the intended IP address field. The concatenation of commands using semicolons presents a significant risk, potentially enabling unauthorized control over the system.

References