CVE-2021-27175
📋 TL;DR
CVE-2021-27175 exposes WiFi passwords in cleartext within a configuration file on FiberHome HG6245D devices. This allows any local user or process to read sensitive credentials without authentication. Affected users are those with FiberHome HG6245D devices running firmware through RP2613.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to the WiFi network, potentially compromising all connected devices and enabling man-in-the-middle attacks.
Likely Case
Local users or malware on the device can steal WiFi credentials, leading to unauthorized network access.
If Mitigated
With proper network segmentation and access controls, impact is limited to the local device only.
🎯 Exploit Status
Exploitation requires local access to the device but is trivial once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check with FiberHome for firmware updates.
🔧 Temporary Workarounds
Change file permissions
linuxRestrict read access to the wifictl_2g.cfg file to prevent unauthorized reading
chmod 600 /path/to/wifictl_2g.cfg
Encrypt sensitive data
linuxManually encrypt WiFi passwords in configuration files
Use device-specific encryption tools if available
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access to the device
- Monitor for suspicious file access attempts to wifictl_2g.cfg
🔍 How to Verify
Check if Vulnerable:
Check if /path/to/wifictl_2g.cfg exists and has 0644 permissions with cleartext passwordsCheck Version:
Check firmware version through device web interface or CLIVerify Fix Applied:
Verify file permissions are restricted (e.g., 600) and passwords are no longer in cleartext📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to wifictl_2g.cfg file
Network Indicators:
- Unexpected devices connecting to WiFi network
SIEM Query:
file_access AND file_path:"*wifictl_2g.cfg*" AND user:!authorized_user