CVE-2021-27159
📋 TL;DR
FiberHome HG6245D devices contain hardcoded administrative credentials (useradmin/888888) in their web daemon, allowing unauthorized access to the device's management interface. This affects all devices through firmware version RP2613. Attackers can gain administrative control over affected routers.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with ability to modify network configuration, intercept traffic, deploy malware to connected devices, or use as pivot point for internal network attacks.
Likely Case
Unauthorized administrative access to router management interface leading to network configuration changes, DNS hijacking, or credential harvesting.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Exploitation requires only web browser or curl command with hardcoded credentials; trivial to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Contact FiberHome or ISP for firmware updates. No official patch information is publicly documented.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to router management interface using firewall rules
ISP Configuration Lock
allRequest ISP to lock configuration changes if device is ISP-managed
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules
- Monitor for authentication attempts to router management interface
🔍 How to Verify
Check if Vulnerable:
Attempt to login to router web interface at http://[router-ip] using credentials useradmin/888888Check Version:
Check router web interface or contact ISP for firmware versionVerify Fix Applied:
Verify login with hardcoded credentials fails; check firmware version is newer than RP2613📡 Detection & Monitoring
Log Indicators:
- Successful authentication with useradmin account
- Multiple failed login attempts followed by success
Network Indicators:
- HTTP POST requests to login endpoints with hardcoded credentials
- Unusual configuration changes from router
SIEM Query:
source="router_logs" AND (user="useradmin" OR password="888888")