VulnerabilityModified

CVE-2021-27178

An issue was discovered on FiberHome HG6245D devices through RP2613.

HIGH 7.5EPSS 18.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 18.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 18.18% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-312
Affected: fiberhome/hg6245d firmware
Source: cve@mitre.org

References

https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html#system-credentials-clear-text-nvramExploit, Third Party Advisory
https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html#system-credentials-clear-text-nvramExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.