CVE-2021-27145
📋 TL;DR
FiberHome HG6245D devices contain hardcoded admin credentials (admin/lnadmin) in the web daemon, allowing attackers to gain administrative access. This affects all devices through firmware version RP2613. The vulnerability enables complete compromise of the device.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control, can reconfigure the device, intercept network traffic, install malware, or use as a pivot point into internal networks.
Likely Case
Unauthorized administrative access leading to device configuration changes, network monitoring, or credential harvesting.
If Mitigated
Limited impact if device is behind firewall with restricted administrative access and network segmentation.
🎯 Exploit Status
Exploitation requires only web browser access to the management interface using credentials admin/lnadmin.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
Contact FiberHome or ISP for firmware updates. No official patch information available.
🔧 Temporary Workarounds
Disable web management interface
allDisable the vulnerable web daemon if not required for operation
Specific commands depend on device configuration and access level
Network access restrictions
linuxRestrict access to the management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate device on separate VLAN with strict network segmentation
- Implement network monitoring for unauthorized access attempts to management interface
🔍 How to Verify
Check if Vulnerable:
Attempt to access the device web interface at http://[device-ip] using credentials admin/lnadminCheck Version:
Check firmware version in web interface or via telnet/ssh if availableVerify Fix Applied:
Verify that admin/lnadmin credentials no longer work and that new unique credentials are required📡 Detection & Monitoring
Log Indicators:
- Successful authentication with admin/lnadmin credentials
- Multiple failed login attempts followed by admin login
Network Indicators:
- HTTP requests to device management interface from unexpected sources
- Traffic patterns indicating configuration changes
SIEM Query:
source="device_logs" (username="admin" OR username="lnadmin") AND action="login_success"