CVE-2021-27163
📋 TL;DR
CVE-2021-27163 is a critical authentication bypass vulnerability affecting FiberHome HG6245D optical network terminals. The devices contain hardcoded admin credentials (admin/tele1234) in their web interface, allowing attackers to gain administrative access without authentication. This affects all FiberHome HG6245D devices through firmware version RP2613.
💻 Affected Systems
- FiberHome HG6245D Optical Network Terminal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the network device allowing reconfiguration of network settings, interception of traffic, installation of persistent backdoors, and potential lateral movement to connected networks.
Likely Case
Unauthorized administrative access to the device allowing network configuration changes, service disruption, and credential harvesting from connected devices.
If Mitigated
Limited impact if device is behind firewalls, not internet-facing, and network segmentation prevents lateral movement from compromised device.
🎯 Exploit Status
Exploitation is trivial - simply navigate to the web interface and use admin/tele1234 credentials. No special tools or skills required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after RP2613
Vendor Advisory: https://www.fiberhome.com/security-advisory (vendor advisory may not be publicly accessible)
Restart Required: Yes
Instructions:
1. Contact ISP or FiberHome for updated firmware. 2. Download the firmware file. 3. Log into device web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and apply the new firmware. 6. Device will reboot automatically.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the vulnerable web interface entirely if not needed for management
Access device via telnet/SSH if available
Navigate to network settings
Disable HTTP/HTTPS management services
Network Access Control
linuxRestrict access to device management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate the device on a separate VLAN with strict firewall rules preventing any inbound connections to its management interface
- Implement network monitoring for unauthorized access attempts to the device's web interface on ports 80/443
🔍 How to Verify
Check if Vulnerable:
Attempt to log into the device web interface at http://[device-ip] using credentials admin/tele1234. If login succeeds, device is vulnerable.Check Version:
Log into web interface and check System Information > Device Info > Software Version, or use: curl -s http://[device-ip]/getpage.gch?pid=1002&nextpage=status_dev_info_t.gch | grep -i 'software version'Verify Fix Applied:
After patching, attempt to log in with admin/tele1234 credentials. Login should fail. Check firmware version is greater than RP2613.📡 Detection & Monitoring
Log Indicators:
- Successful authentication with admin account from unexpected IP addresses
- Multiple failed login attempts followed by successful admin login
- Configuration changes made outside maintenance windows
Network Indicators:
- HTTP POST requests to login.cgi with admin credentials from unauthorized sources
- Unusual traffic patterns to device management interface
SIEM Query:
source="device_logs" (user="admin" AND (src_ip NOT IN ["10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12"] OR src_ip NOT IN allowed_admin_ips))