CVE-2021-27151
📋 TL;DR
FiberHome HG6245D optical network terminal devices contain hardcoded root credentials (rootmet/m3tr0r00t) in their web daemon. This allows attackers to gain administrative access to the device's web interface. All users of affected FiberHome HG6245D devices through firmware version RP2613 are vulnerable.
💻 Affected Systems
- FiberHome HG6245D Optical Network Terminal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the optical network terminal, allowing attackers to reconfigure network settings, intercept traffic, deploy malware, or use the device as a pivot point into the internal network.
Likely Case
Unauthorized administrative access to the device web interface, enabling network configuration changes, service disruption, and credential harvesting.
If Mitigated
Limited impact if device is behind firewall with restricted web interface access and strong network segmentation.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to navigate to the web interface and use the hardcoded credentials. No special tools or skills required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after RP2613
Vendor Advisory: https://www.fiberhome.com/security-advisory/
Restart Required: Yes
Instructions:
1. Contact your ISP or FiberHome for updated firmware. 2. Download the firmware update. 3. Log into device web interface. 4. Navigate to firmware update section. 5. Upload and apply the new firmware. 6. Reboot the device.
🔧 Temporary Workarounds
Disable Web Interface
allDisable the web management interface if not required for operations
telnet 192.168.1.1
login: root
password: rootmet
disable httpd
Restrict Web Interface Access
linuxConfigure firewall rules to restrict access to the web interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate the device on a separate VLAN with strict access controls
- Implement network monitoring for authentication attempts using the hardcoded credentials
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the web interface at http://[device-ip] using username 'rootmet' and password 'm3tr0r00t'Check Version:
telnet [device-ip] 23, then run 'cat /etc/version' or check web interface system info pageVerify Fix Applied:
Attempt to log in with hardcoded credentials - should fail. Check firmware version is greater than RP2613.📡 Detection & Monitoring
Log Indicators:
- Successful authentication with username 'rootmet'
- Multiple failed login attempts followed by successful 'rootmet' login
Network Indicators:
- HTTP POST requests to login endpoint with hardcoded credentials
- Unusual administrative configuration changes
SIEM Query:
source="device_logs" (username="rootmet" AND auth_result="success")