Multiple backdoors and Vulnerabilities Found in FiberHome Routers

More than 25 backdoors have detected in FTTH ONT (Fiber-to-the-Home Optical Network Terminal) Routers.

FTTH ONT are the special devices in the router which are placed at the end of the optical cable, its role is to convert the optical signals received through the optical cable into Ethernet or wireless signals. More than 25 backdoor accounts and multiple vulnerabilities have been found in FTTH ONT routers developed by the Chinese manufacture FiberHome Networks.

In a report, security researcher Pierre Kim said he found multiple security threats in two router models FiberHome HG6245D and FiberHome RP2602 by FiberHome networks.

Firstly, the researcher stated that both the devices are not vulnerable to IPv4 external interface, making its management panel non-accessible and also Telnet management feature is disabled. However, the case is not the same with IPv6 external interface the device's firewall is only active on IPv4 and not on IPv6 which allows access to all the internal service and management panel of the device if one only knows the IPv6 address of a device. Pierre Kim discovered multiple security issues like:

Device details were leaked when the management interface was accessed while Javascript turned off. In the details device MAC address is also included.
Telnet connection can be initiated using device MAC address with special HTTP request [https://[ip]/telnet?enable=0&key=calculated(BR0_MAC)].
Cookies and Passwords of admin panels are stored in clear text in HTTP logs.
Kim also published a list of 22 credentials present in the management interface.

Also, some encrypted credentials were found in management's binary however the XOR key for decryption was also present in binary making the encryption useless.
A privilege escalation vulnerability was also found by Kim which allows access to Root Level.
Passwords for the different services of router are stored in clear text inside routers NVRAM.

Pierre Kim also stated "that some backdoors have been intentionally placed by the vendor." further he said he had reported these security issues to the FiberHome Networks. Adding to this, The U.S department in May 2020 has blacklisted the FiberHome Networks along with eight other Chinese companies restricting their access to the U.S.

Multiple backdoors and Vulnerabilities Found in FiberHome Routers

Related threat feeds

FIFA World Cup Broadcast Infrastructure Exposed Through Broken Authorization Flaw

More than 25 backdoors have detected in FTTH ONT (Fiber-to-the-Home Optical Network Terminal) Routers.

Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution

ServiceNow MID Server Authentication Bypass Exploited to Extract Data from 341 Customer Instances