CVE-2021-27143
📋 TL;DR
FiberHome HG6245D devices contain hardcoded credentials (user/user1234) in their web daemon, allowing attackers to gain administrative access to the device's web interface. This affects all FiberHome HG6245D devices through firmware version RP2613. The vulnerability enables complete device compromise.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over the device, allowing them to reconfigure network settings, intercept traffic, install malware, or use the device as a pivot point into internal networks.
Likely Case
Unauthorized users access the web interface to change device settings, monitor network traffic, or disable security features.
If Mitigated
If devices are behind firewalls with strict access controls, risk is limited to internal attackers or those who bypass perimeter defenses.
🎯 Exploit Status
Exploitation requires only web browser access to the device's management interface using the published credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Contact FiberHome for firmware updates or replace affected devices.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate network segments with strict firewall rules
Access Control Lists
allImplement IP-based access restrictions to the device management interface
🧯 If You Can't Patch
- Replace affected devices with models from different vendors
- Disable web management interface if not required for operation
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the device web interface at http://[device-ip] using credentials user/user1234Check Version:
Check firmware version in device web interface or via serial consoleVerify Fix Applied:
Verify that user/user1234 credentials no longer provide access to the web interface📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful login with 'user' account
- Configuration changes from 'user' account
Network Indicators:
- HTTP requests to device management interface from unexpected sources
- Traffic patterns indicating device reconfiguration
SIEM Query:
source_ip="device_ip" AND (http_user_agent CONTAINS "Mozilla" OR http_method="POST") AND http_path CONTAINS "/cgi-bin"