CVE-2017-14147
📋 TL;DR
This vulnerability allows unauthenticated attackers to factory reset FiberHome AN1020-25 routers by accessing a specific URL. Attackers can then use default credentials to gain administrative access. Only users of the affected router model are impacted.
💻 Affected Systems
- FiberHome AN1020-25 ADSL Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing network traffic interception, DNS hijacking, and lateral movement into connected devices.
Likely Case
Router takeover leading to internet service disruption, credential theft, and unauthorized network access.
If Mitigated
No impact if router is not internet-facing or has been patched/updated.
🎯 Exploit Status
Simple HTTP GET request to /restoreinfo.cgi triggers factory reset. Multiple public exploit scripts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check with vendor
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Contact FiberHome for firmware updates. 2. Download latest firmware from vendor portal. 3. Upload via router admin interface. 4. Reboot router after update.
🔧 Temporary Workarounds
Block External Access
linuxConfigure firewall to block WAN access to router admin interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Change Default Credentials
allChange router admin password from default to prevent post-reset access
🧯 If You Can't Patch
- Replace router with different model that doesn't have this vulnerability
- Place router behind separate firewall that blocks all external management access
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[router-ip]/restoreinfo.cgi from network. If page loads without authentication, vulnerable.Check Version:
Check router web interface or use nmap -sV -p80 [router-ip]Verify Fix Applied:
After update, same URL should require authentication or return 404/403 error.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /restoreinfo.cgi
- Router configuration reset events
- Multiple failed login attempts after reset
Network Indicators:
- Unusual HTTP traffic to router management interface
- DNS changes to malicious servers
- Unexpected factory reset commands
SIEM Query:
source="router.log" AND (uri="/restoreinfo.cgi" OR event="factory_reset")🔗 References
- http://packetstormsecurity.com/files/144022/FiberHome-Unauthenticated-ADSL-Router-Factory-Reset.html
- https://beefaaubee09.github.io/fiberhome-adsls-dos/
- https://www.exploit-db.com/exploits/42649/
- http://packetstormsecurity.com/files/144022/FiberHome-Unauthenticated-ADSL-Router-Factory-Reset.html
- https://beefaaubee09.github.io/fiberhome-adsls-dos/
- https://www.exploit-db.com/exploits/42649/
