CVE-2021-27139
📋 TL;DR
This vulnerability allows unauthenticated attackers to extract sensitive information from FiberHome HG6245D devices by disabling JavaScript and accessing the /info.asp endpoint. It affects FiberHome HG6245D devices through firmware version RP2613. The information leak could expose device details and potentially aid further attacks.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive device information that could be used to launch follow-up attacks, potentially leading to full device compromise or network infiltration.
Likely Case
Unauthenticated information disclosure revealing device details, configuration data, and potentially credentials or network information.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to device management interfaces.
🎯 Exploit Status
Simple HTTP request to /info.asp with JavaScript disabled; detailed in public research blog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Check with FiberHome for firmware updates beyond RP2613; no official patch documented in public sources.
🔧 Temporary Workarounds
Restrict Web Interface Access
linuxBlock external access to device management interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable Unnecessary Services
allDisable HTTP/HTTPS services if not required for device management.
Check device admin interface for service disable options
🧯 If You Can't Patch
- Segment network to isolate vulnerable devices from untrusted networks
- Implement strict access controls allowing only authorized IPs to access management interface
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[device-ip]/info.asp with JavaScript disabled in browser; if information is displayed without authentication, device is vulnerable.Check Version:
Check firmware version in device admin interface or via serial consoleVerify Fix Applied:
After applying workarounds, verify /info.asp endpoint is no longer accessible or requires authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple unauthenticated requests to /info.asp
- Access from unusual IP addresses to management interface
Network Indicators:
- HTTP GET requests to /info.asp without authentication headers
- Traffic to device management ports from external networks
SIEM Query:
source="device_logs" AND url="/info.asp" AND auth_status="failed"