CVE-2021-27171
📋 TL;DR
This vulnerability allows attackers to start a telnet daemon with root privileges on FiberHome HG6245D devices by using specific CLI commands. This enables complete device compromise and potential network access. Affected are FiberHome HG6245D devices through firmware version RP2613.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise leading to network infiltration, data interception, and use as pivot point for attacking other network devices.
Likely Case
Local network attackers gain root access to the device, enabling configuration changes, traffic monitoring, and persistence.
If Mitigated
With proper network segmentation and access controls, impact limited to isolated device compromise.
🎯 Exploit Status
Exploitation requires CLI access but commands are simple and documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later than RP2613
Vendor Advisory: https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Contact FiberHome for updated firmware. 3. Backup configuration. 4. Apply firmware update. 5. Reboot device. 6. Verify fix.
🔧 Temporary Workarounds
Disable CLI Access
allRestrict or disable CLI interface access to prevent command execution
Network Segmentation
allIsolate affected devices in separate VLAN with strict access controls
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Monitor for telnet connections on port 26 and block suspicious activity
🔍 How to Verify
Check if Vulnerable:
Attempt to access CLI interface and execute 'ddd' and 'shell' or 'tshell' commandsCheck Version:
Check device web interface or use CLI command to display firmware versionVerify Fix Applied:
Check firmware version is later than RP2613 and verify CLI commands no longer start telnetd📡 Detection & Monitoring
Log Indicators:
- CLI command execution logs showing 'ddd' or 'shell' commands
- Telnet service startup on port 26
Network Indicators:
- Unexpected telnet connections to port 26
- Network scans targeting port 26
SIEM Query:
destination_port:26 AND protocol:telnet