CVE-2021-27169
📋 TL;DR
CVE-2021-27169 is a critical vulnerability affecting FiberHome AN5506-04-FA optical network terminals with firmware RP2631. It involves hardcoded credentials (gepon password for gepon account) that allow attackers to gain unauthorized access. This affects organizations and individuals using these specific FiberHome devices.
💻 Affected Systems
- FiberHome AN5506-04-FA
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the optical network terminal, allowing attackers to intercept/modify network traffic, deploy malware, pivot to internal networks, or disrupt internet services.
Likely Case
Unauthorized administrative access to the device, enabling configuration changes, service disruption, or credential harvesting from connected devices.
If Mitigated
Limited impact if devices are behind firewalls, not internet-facing, and network segmentation prevents lateral movement from compromised devices.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to connect via telnet/SSH using gepon:gepon credentials. Public exploit scripts and detailed documentation exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after RP2631 (check with vendor for specific fixed version)
Vendor Advisory: https://www.fiberhome.com/security/ (vendor-specific advisory may exist)
Restart Required: Yes
Instructions:
1. Contact FiberHome for updated firmware. 2. Backup device configuration. 3. Upload new firmware via web interface. 4. Reboot device. 5. Verify gepon account password is changed or disabled.
🔧 Temporary Workarounds
Disable gepon account
linuxRemove or disable the gepon account if not required for operations
telnet [device_ip]
login: gepon
password: gepon
userdel gepon OR passwd gepon (set strong password)
Network isolation
allPlace devices in isolated VLANs with strict firewall rules
🧯 If You Can't Patch
- Change gepon account password to a strong, unique value immediately
- Disable telnet/SSH access from untrusted networks and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Attempt telnet/SSH connection to device port 23/22 using credentials gepon:gepon. If login succeeds, device is vulnerable.Check Version:
telnet [device_ip] then check firmware version in web interface at http://[device_ip] or via CLI after loginVerify Fix Applied:
Attempt login with old credentials gepon:gepon - should fail. Verify gepon account has strong password or is disabled.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts for gepon account
- Successful logins from unexpected IPs to gepon account
- Configuration changes by gepon user
Network Indicators:
- Telnet/SSH connections to device from external IPs
- Unusual outbound connections from device
SIEM Query:
source="device_logs" (user="gepon" AND (action="login" OR action="config_change"))