CVE-2021-27179
📋 TL;DR
This vulnerability allows remote attackers to crash the telnet daemon on FiberHome HG6245D devices by sending a specific malformed string. This causes a denial-of-service condition, disrupting telnet access. Affected users are those running vulnerable versions of FiberHome HG6245D devices with telnet enabled.
💻 Affected Systems
- FiberHome HG6245D
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service rendering telnet service unavailable, potentially requiring device reboot to restore functionality.
Likely Case
Temporary telnet service disruption until the daemon restarts or device reboots.
If Mitigated
No impact if telnet is disabled or devices are patched/isolated.
🎯 Exploit Status
Simple string transmission causes crash; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
No official patch available. Check with FiberHome for firmware updates beyond RP2613.
🔧 Temporary Workarounds
Disable telnet service
allCompletely disable the telnet daemon to prevent exploitation.
Specific commands vary by device configuration. Typically via web interface: Administration > Services > Disable Telnet
Restrict network access
linux/windowsBlock telnet port (23) at network perimeter or firewall.
iptables -A INPUT -p tcp --dport 23 -j DROP
netsh advfirewall firewall add rule name="Block Telnet" dir=in action=block protocol=TCP localport=23
🧯 If You Can't Patch
- Disable telnet service entirely and use SSH if available.
- Isolate affected devices in separate network segments with strict access controls.
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. If version is RP2613 or earlier with telnet enabled, device is vulnerable.Check Version:
Device-specific; typically via web interface or telnet/SSH login and checking firmware info.Verify Fix Applied:
Verify telnet service is disabled or device firmware is updated beyond RP2613.📡 Detection & Monitoring
Log Indicators:
- Telnet daemon crash logs
- Repeated connection attempts to port 23 with specific payload patterns
Network Indicators:
- Traffic to port 23 containing hex string 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a
SIEM Query:
destination_port:23 AND payload_contains:"0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a"