Fiberhome

13 CVEs across 38 Fiberhome products. Browse Fiberhome vulnerabilities, severities, and proof-of-concept exploits.

Fiberhome products with known CVEs

ProductCVEs
Hg6245d41
Hg6245d Firmware40
An5506-01-A4
An5506-01-A Firmware4
An5506-01a Onu Gpon4
Lm53q13
Lm53q1 Firmware3
An5506-02-B2
An5506-02-B Firmware2
An5506-04-Fa2
Hg150-Ub2
Hg150-Ub Firmware2
Hg2201t2
Hg2201t Firmware2
Vdsl2 Modem Hg 150-Ub2
Vdsl2 Modem Hg 150-Ub Firmware2
Aan5506-04-G2g Firmware1
Adsl An1020-251
Adsl An1020-25 Firmware1
An5506-01a1
An5506-01a Firmware1
An5506-01-B1
An5506-01-B Firmware1
An5506-04-B1
An5506-04-B Firmware1
An5506-04-F1
An5506-04-Fa Firmware1
An5506-04-F Firmware1
An5506-04-G2g1
Fengine 28f-S1
Fengine 52f-S1
Fengine 52t-S1
Fengine S5800-28t-S1
Fengine S5800-28t-S-Pe1
Fengine S5800 Firmware1
Hg6145f11
Hg6145f1 Firmware1
Routerfiberhome Firmware1
Fiberhome CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2021-44642025-11-12FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('we…
CVE-2025-63353Critical9.82025-11-12A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSI…
CVE-2025-1616Medium4.72025-02-24A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality…
CVE-2025-1615Low2.42025-02-24A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the…
CVE-2025-1614Low2.42025-02-24A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwa…
CVE-2025-1613Low2.42025-02-24A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /go…
CVE-2022-38814Medium5.42022-09-15A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scr…
CVE-2022-36200High7.52022-08-29In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
CVE-2021-41946Medium5.42022-05-18In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a…
CVE-2021-42912High8.82021-12-16FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send com…
CVE-2021-27179High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02…
CVE-2021-27178High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
CVE-2021-27177Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3…
CVE-2021-27176High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions.
CVE-2021-27175High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions.
CVE-2021-27174High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions.
CVE-2021-27173High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, p…
CVE-2021-27172Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
CVE-2021-27171Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on port 26/tcp by using the CLI interface…
CVE-2021-27170Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal manag…
CVE-2021-27169Critical9.82021-02-10An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account.
CVE-2021-27168Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account.
CVE-2021-27167Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters…
CVE-2021-27166Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon.
CVE-2021-27165Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials.
CVE-2021-27164Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP.
CVE-2021-27163Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP.
CVE-2021-27162Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.
CVE-2021-27161Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP.
CVE-2021-27160Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP.
CVE-2021-27159Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP.
CVE-2021-27158Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.
CVE-2021-27157Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP.
CVE-2021-27156Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address…
CVE-2021-27155Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an…
CVE-2021-27154Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP.
CVE-2021-27153Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP.
CVE-2021-27152Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
CVE-2021-27151Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
CVE-2021-27150Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credent…
CVE-2021-27149Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for…
CVE-2021-27148Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
CVE-2021-27147Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
CVE-2021-27146Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
CVE-2021-27145Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
CVE-2021-27144Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credential…
CVE-2021-27143Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
CVE-2021-27142High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permiss…
CVE-2021-27141Critical9.82021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98s…
CVE-2021-27140High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web…
CVE-2021-27139High7.52021-02-10An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling…
CVE-2019-17186High8.82019-10-08/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.
CVE-2019-17187High7.52019-10-08/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary fil…
CVE-2018-9249Critical9.82018-04-04FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthen…
CVE-2018-9248Critical9.82018-04-04FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header.
CVE-2017-16887Critical9.82018-01-12The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t…
CVE-2017-16886High8.82018-01-12The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t…
CVE-2017-16885Critical9.82018-01-12Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passw…
CVE-2017-15647High7.52017-10-19On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.
CVE-2017-14147Critical9.82017-09-07An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory se…
CVE-2017-5544Medium5.92017-01-23An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking t…