CVE-2025-1616

MEDIUM

FiberHome AN5506-01A ONU GPON RP2511 - OS Command Injection via Diagnosis Destination Address

Title source: llm
STIX 2.1

Description

A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.296606
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.296606
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.501483

Scores

CVSS v3 4.7
EPSS 0.0874
EPSS Percentile 94.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (1)
fiberhome/an5506-01a_firmware rp2511
Published Feb 24, 2025
Tracked Since Feb 18, 2026