CVE-2021-27157
📋 TL;DR
CVE-2021-27157 is a critical authentication bypass vulnerability affecting FiberHome HG6245D optical network terminals. The web daemon contains hardcoded admin credentials (admin/888888) that allow attackers to gain administrative access. This affects all users of FiberHome HG6245D devices through firmware version RP2613.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the network device allowing reconfiguration of network settings, traffic interception, device takeover, and potential lateral movement into connected networks.
Likely Case
Unauthorized administrative access to the device enabling network configuration changes, service disruption, and credential harvesting.
If Mitigated
Limited impact if device is behind firewalls, not internet-facing, and network segmentation prevents lateral movement.
🎯 Exploit Status
Exploitation is trivial - simply navigate to the web interface and use admin/888888 credentials. No special tools or skills required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after RP2613
Vendor Advisory: https://www.fiberhome.com/security-advisory (vendor-specific advisory may not be publicly available)
Restart Required: Yes
Instructions:
1. Contact ISP or FiberHome for updated firmware. 2. Backup current configuration. 3. Upload new firmware via web interface. 4. Reboot device. 5. Restore configuration if needed.
🔧 Temporary Workarounds
Disable web management interface
allDisable the vulnerable web daemon if remote management is not required
telnet 192.168.1.1
login with admin credentials
disable httpd service
Network isolation
linuxPlace device behind firewall with strict access controls
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate the device on a separate VLAN with strict firewall rules blocking all inbound access to management interfaces
- Implement network monitoring and alerting for authentication attempts using the hardcoded credentials
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the web interface at http://[device-ip] using username 'admin' and password '888888'Check Version:
Check web interface status page or use telnet/ssh to connect and check firmware versionVerify Fix Applied:
Verify that admin/888888 credentials no longer work and that new firmware version is installed📡 Detection & Monitoring
Log Indicators:
- Successful authentication with admin account
- Multiple failed login attempts followed by admin login
- Configuration changes from unknown IP addresses
Network Indicators:
- HTTP POST requests to login endpoints with admin credentials
- Unusual traffic patterns from device management interface
SIEM Query:
source="device_logs" (username="admin" AND (password="888888" OR auth_success="true"))