CVE-2021-27141
📋 TL;DR
CVE-2021-27141 is a critical credential exposure vulnerability affecting FiberHome HG6245D devices. The credentials stored in /fhconf/umconfig.txt are obfuscated using a weak XOR algorithm with a hardcoded key, allowing attackers to easily decrypt sensitive information. This affects all users of FiberHome HG6245D devices through firmware version RP2613.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the device, enabling complete compromise including network traffic interception, device reconfiguration, and potential lateral movement into connected networks.
Likely Case
Attackers extract administrative credentials and gain full control over the affected router/gateway device.
If Mitigated
With proper network segmentation and access controls, impact is limited to the compromised device only.
🎯 Exploit Status
Exploitation requires access to the configuration file, which may be accessible via web interface or file system access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
No official patch available. Contact FiberHome for firmware updates.
🔧 Temporary Workarounds
Remove configuration file access
linuxRestrict access to the /fhconf/umconfig.txt file to prevent credential extraction
chmod 600 /fhconf/umconfig.txt
chown root:root /fhconf/umconfig.txt
Change default credentials
allChange all default administrative credentials on affected devices
🧯 If You Can't Patch
- Isolate affected devices in separate network segments
- Implement strict firewall rules limiting access to device management interfaces
🔍 How to Verify
Check if Vulnerable:
Check if /fhconf/umconfig.txt exists and contains XOR-obfuscated credentials. Use the hardcoded key to attempt decryption.Check Version:
Check firmware version via device web interface or CLIVerify Fix Applied:
Verify that credentials in umconfig.txt are properly encrypted or that the file is no longer accessible.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access to /fhconf/ directory
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual traffic patterns from device management interface
- External connections to device administrative ports
SIEM Query:
source="router_logs" AND (path="/fhconf/umconfig.txt" OR event="configuration_access")