CVE-2021-42912: Fiberhome AAN5506-04-g2g Firmware

High severity, CVSS 8.8. EPSS: 10.1% chance of exploitation in the next 30 days.

FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.

Affected products

• Fiberhome AAN5506-04-g2g Firmware: version rp2560 only
• Fiberhome AN5506-01-A Firmware: version rp0509 only
• Fiberhome AN5506-01-B Firmware: version rp2610 only
• Fiberhome AN5506-02-B Firmware: version rp2520 only; version rp2521 only; version rp2603 only
• Fiberhome AN5506-04-B Firmware: version rp2510 only
• Fiberhome AN5506-04-F Firmware: version rp2617 only

Published 2021-12-16. Last modified 2026-07-09.