CVE-2021-27167
📋 TL;DR
CVE-2021-27167 is a critical authentication bypass vulnerability affecting FiberHome HG6245D optical network terminals. The admin account has a hardcoded password consisting of only four hexadecimal characters, allowing attackers to gain administrative access. This affects all users of FiberHome HG6245D devices through firmware version RP2613.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over the device, enabling them to intercept network traffic, modify configurations, install malware, or use the device as a pivot point into internal networks.
Likely Case
Attackers exploit the hardcoded credentials to gain administrative access, potentially compromising the device and any connected networks.
If Mitigated
With proper network segmentation and access controls, the impact is limited to the affected device only.
🎯 Exploit Status
Exploitation requires only knowledge of the hardcoded password, which has been publicly documented. The vulnerability is easily weaponized due to the simplicity of the attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after RP2613
Vendor Advisory: https://www.fiberhome.com/security-advisory
Restart Required: Yes
Instructions:
1. Contact FiberHome for updated firmware. 2. Backup current configuration. 3. Upload and install the patched firmware. 4. Reboot the device. 5. Verify the fix by checking the firmware version.
🔧 Temporary Workarounds
Disable Telnet/SSH Access
allDisable remote administrative access protocols to prevent exploitation.
telnet_disable
ssh_disable
Change Admin Password
allChange the admin password to a strong, unique value if the device allows password changes.
admin_password_change
🧯 If You Can't Patch
- Isolate the device in a separate network segment with strict firewall rules.
- Monitor network traffic for unauthorized access attempts and implement intrusion detection.
🔍 How to Verify
Check if Vulnerable:
Check the firmware version via the device web interface or CLI. If version is RP2613 or earlier, the device is vulnerable.Check Version:
show versionVerify Fix Applied:
Verify the firmware version is updated to a version after RP2613 and test authentication with the previously known hardcoded password.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful admin login
- Telnet/SSH connections from unexpected sources
Network Indicators:
- Telnet/SSH traffic to the device from unauthorized IPs
- Unusual outbound connections from the device
SIEM Query:
source="ONT" AND (event_type="authentication" AND result="success" AND user="admin")