VulnerabilityModified

CVE-2021-27166

An issue was discovered on FiberHome HG6245D devices through RP2613.

CRITICAL 9.8EPSS 19.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 19.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 19.84% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-798
Affected: fiberhome/hg6245d firmware
Source: cve@mitre.org

References

https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html#telnet-linux-hardcoded-credentialsExploit, Third Party Advisory
https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html#telnet-linux-hardcoded-credentialsExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.