CVE-2021-27142 in HG6245D
Summary
by MITRE • 02/11/2021
An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/28/2021
The vulnerability identified as CVE-2021-27142 affects FiberHome HG6245D broadband routers operating with firmware version RP2613 and earlier. This critical security flaw resides in the device's web management interface implementation where the system employs a hardcoded private key for HTTPS encryption. The issue represents a fundamental failure in cryptographic key management practices that compromises the entire security posture of the affected devices. The hardcoded nature of the private key eliminates the possibility of proper key rotation or secure key distribution mechanisms, creating a persistent vulnerability that affects all devices running the vulnerable firmware.
The technical flaw manifests through the use of a static private key that is embedded within the device firmware during manufacturing. This hardcoded key has 0777 permissions, indicating that the key file is accessible with full read, write, and execute permissions for all users on the system. This permission structure creates an extremely dangerous situation where any local user or attacker with access to the device can easily extract the private key. The combination of a hardcoded cryptographic key with overly permissive file permissions creates a scenario where the encryption mechanism becomes completely ineffective for authentication and data protection purposes. This vulnerability directly violates security best practices outlined in the OWASP Top Ten and NIST cybersecurity guidelines for secure key management.
The operational impact of this vulnerability is severe and multifaceted across multiple threat vectors. Attackers can exploit this weakness to perform man-in-the-middle attacks on the HTTPS communications between the device and its administrators, potentially intercepting sensitive configuration data, user credentials, and network management information. The hardcoded key allows unauthorized parties to impersonate the device in network communications, enabling them to inject malicious commands or modify device configurations without detection. This vulnerability affects not only the device's own security but also creates potential risks for the entire network infrastructure, as compromised devices can serve as entry points for broader network attacks. The vulnerability aligns with attack techniques described in the MITRE ATT&CK framework under the T1071.001 tactic for application layer protocol usage and T1566 for credential access through network infiltration.
Mitigation strategies for this vulnerability require immediate action from network administrators and device owners. The most effective immediate solution involves updating the firmware to a version that addresses this hardcoded key issue and implements proper cryptographic key management practices. Organizations should also implement network segmentation to limit the exposure of these devices and consider disabling unnecessary web management interfaces when possible. Security monitoring should be enhanced to detect unusual network traffic patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of following security standards such as those defined in CWE-310, which addresses cryptographic weakness, and CWE-706, which covers use of unsafe functions. Additionally, this issue highlights the necessity of proper access control implementation as defined in CWE-284, which addresses improper access control mechanisms, and reinforces the need for secure configuration management practices aligned with NIST SP 800-53 security controls.