Fiberhome 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk csrf and vendor risk memory corruption などに関し、一部は vendor impact memory corruption を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-63353 | A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction. | [email protected] | 9.8 | 0.84% | 2025-11-12 | 2025-12-31 |
| CVE-2025-1616 | A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 5.1 | 0.10% | 2025-02-24 | 2025-02-28 |
| CVE-2025-1615 | A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the component NAT Submenu. The manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 4.8 | 0.06% | 2025-02-24 | 2025-02-28 |
| CVE-2025-1614 | A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 4.8 | 0.06% | 2025-02-24 | 2025-02-28 |
| CVE-2025-1613 | A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /goform/URL_filterCfg of the component URL Filtering Submenu. The manipulation of the argument url_IP leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | [email protected] | 4.8 | 0.06% | 2025-02-24 | 2025-02-28 |
| CVE-2022-38814 | A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field. | [email protected] | 5.4 | 0.37% | 2022-09-15 | 2024-11-21 |
| CVE-2022-36200 | In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. | [email protected] | 7.5 | 0.23% | 2022-08-29 | 2024-11-21 |
| CVE-2021-41946 | In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a user cannot delete the rule due to the XSS. | [email protected] | 5.4 | 0.06% | 2022-05-18 | 2024-11-21 |
| CVE-2021-42912 | FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon. | [email protected] | 8.8 | 0.10% | 2021-12-16 | 2024-11-21 |
| CVE-2021-27179 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a string. | [email protected] | 7.5 | 0.04% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27178 | An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram. | [email protected] | 7.5 | 0.04% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27177 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3QKd2hvCg== string to the telnet server. | [email protected] | 9.8 | 0.39% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27176 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions. | [email protected] | 7.5 | 0.04% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27175 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions. | [email protected] | 7.5 | 0.04% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27174 | An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions. | [email protected] | 7.5 | 0.04% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27173 | An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, provided by the HTTP server. This will remove firewall rules and allow an attacker to reach the telnet server (used for the CLI). | [email protected] | 7.5 | 0.05% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27172 | An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh. | [email protected] | 9.8 | 0.64% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27171 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on port 26/tcp by using the CLI interface commands of ddd and shell (or tshell). | [email protected] | 9.8 | 0.10% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27170 | An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet. | [email protected] | 9.8 | 0.07% | 2021-02-10 | 2024-11-21 |
| CVE-2021-27169 | An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account. | [email protected] | 9.8 | 0.64% | 2021-02-10 | 2024-11-21 |