CVE-2026-117082

Not scored yetLast modified Nov 3, 2026

Description

An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Band GPON ONU device allows an attackers to execute arbitrary SOAP requests via port 5555. This flaw exposes 15 administrative, WAN, LAN, and firewall services without requiring credentials, enabling attackers to modify core routing tables, alter DNS servers, remove firewall rules, and completely compromise the network.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 2, 2026
Last modified
Nov 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-11717.5A flaw has been found in birkir prime up to 0.4.0.beta.0. Impacted is an unknown function of the file /graphql of the component GraphQL FielCVE-2026-117106.5IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headeCVE-2026-117116.5IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.CVE-2026-117129.3IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.CVE-2026-1171277.5Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the action_serve fuCVE-2026-117135.4IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnecCVE-2026-117149.8IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enableCVE-2026-117167.5IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbiCVE-2026-117179.1An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. CVE-2026-117189.1An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. CVE-2026-1171825.4An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to exeCVE-2026-1171837.5A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory,
CVE-2026-117082: Unscored | Vulnix