CVE-2021-27149
📋 TL;DR
CVE-2021-27149 is a critical authentication bypass vulnerability affecting FiberHome HG6245D devices. Attackers can use hardcoded admin credentials (adminpldt/z6dUABtl270qRxt7a2uGTiw) to gain administrative access to the web interface. This affects all users of vulnerable FiberHome HG6245D devices through firmware version RP2613.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to reconfigure network settings, intercept traffic, install backdoors, or use the device as a pivot point into internal networks.
Likely Case
Unauthorized administrative access leading to network configuration changes, service disruption, and potential credential harvesting from connected devices.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound rules and network segmentation prevents lateral movement.
🎯 Exploit Status
Exploitation requires only web browser access to the device's management interface using the published credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after RP2613
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Contact ISP or FiberHome for updated firmware. 2. Backup current configuration. 3. Upload new firmware via web interface. 4. Factory reset device. 5. Restore configuration from backup.
🔧 Temporary Workarounds
Network Isolation
allPlace vulnerable devices in isolated network segments with strict firewall rules preventing access to management interfaces.
Access Control Lists
allImplement network ACLs to restrict access to device management interfaces to authorized IP addresses only.
🧯 If You Can't Patch
- Replace vulnerable devices with patched or alternative models
- Implement strict network segmentation and monitor all access attempts to device management interfaces
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the device web interface at http://[device-ip] using credentials adminpldt/z6dUABtl270qRxt7a2uGTiw. Successful login indicates vulnerability.Check Version:
Check web interface status page or use telnet/SSH if available: 'cat /etc/version' or similarVerify Fix Applied:
Attempt to log in with hardcoded credentials after patching - access should be denied. Verify firmware version is newer than RP2613.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful login with adminpldt username
- Configuration changes from unexpected IP addresses
- Multiple authentication attempts in short timeframes
Network Indicators:
- HTTP POST requests to login endpoints with hardcoded credentials
- Unusual traffic patterns from device management interfaces
SIEM Query:
source="device_logs" (username="adminpldt" AND result="success") OR (user_agent CONTAINS "scanner" AND uri="/login.cgi")