CVE-2021-42912
Estado: ModificadaAlta (8.8)—
FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 10%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (6)
CWE
- CWE-78
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-42912",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-12-16T17:15:07.980",
"references": [
{
"url": "https://medium.com/@windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2",
"source": "cve@mitre.org"
},
{
"url": "https://medium.com/%40windsormoreira/fiberhome-an5506-os-command-injection-cve-2021-42912-10b64fd10ce2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon."
},
{
"lang": "es",
"value": "FiberHome ONU GPON AN5506-04-F RP2617 está afectado por una vulnerabilidad de inyección de comandos del Sistema Operativo. Esta vulnerabilidad permite al atacante, una vez iniciada la sesión, enviar comandos al sistema operativo como usuario root por medio de la herramienta de diagnóstico ping, omitiendo el campo de la dirección IP y concatenando los comandos del Sistema Operativo con un punto y coma"
}
],
"lastModified": "2026-07-09T01:17:07.243",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fiberhome:an5506-01-a_firmware:rp0509:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F406D8F8-C111-47B0-AEFE-7A2A838B1DB0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fiberhome:an5506-01-a:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8853CE67-2DD9-4217-B1ED-9767A3E46DE1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fiberhome:an5506-01-b_firmware:rp2610:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12463A6B-5D9D-4F0A-99AE-2D92E6A1B675"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fiberhome:an5506-01-b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2DFCE0D3-8E8D-423B-B7AE-FEDA0CF52350"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fiberhome:an5506-02-b_firmware:rp2520:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "71DE3F3B-4BA1-47C3-AF80-BF80680437C7"
},
{
"criteria": "cpe:2.3:o:fiberhome:an5506-02-b_firmware:rp2521:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77423DD8-4172-4F31-BBFB-D07EEA288091"
},
{
"criteria": "cpe:2.3:o:fiberhome:an5506-02-b_firmware:rp2603:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0805F7D2-B62F-4781-A7D7-2B31C7C15C3D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fiberhome:an5506-02-b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "73640C58-EFEE-4DD6-A5A8-6DC4CADE1C5A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fiberhome:an5506-04-b_firmware:rp2510:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB248B43-EAFD-4F7B-BDF8-AAA9AAA3F667"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fiberhome:an5506-04-b:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8173D80C-412D-44A1-8A93-9BFF803BEFA5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fiberhome:an5506-04-f_firmware:rp2617:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66A2ED72-3B09-49FC-90C4-3A5363D167C2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fiberhome:an5506-04-f:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "19FA255B-431B-4BC4-9B2B-0E4510636351"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fiberhome:aan5506-04-g2g_firmware:rp2560:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B576BC5-F1C6-49F8-9675-91919310AF07"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fiberhome:an5506-04-g2g:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2DA3762F-12D2-4226-9836-4E8BB214266F"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}