External risk intelligence

FiberHome HG6145F1 Predictable Wi-Fi Passwords Allow Network Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63353

The affected product is a GPON ONU (router/modem) deployed at the network edge for residential or small office internet connectivity. These devices are typically physically located at the customer premises and broadcast Wi-Fi SSIDs, making them reachable and discoverable in the immediate local radio environment, which serves as an external-facing interface for wireless access.

Fiberhome Hg6145f1 Firmware

rp4423

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in FiberHome GPON ONU devices that allows factory default Wi-Fi passwords to be predicted based on the network name (SSID). This means an attacker could potentially access the network by simply observing the Wi-Fi name, bypassing the need for authentication.

Predictable Wi-Fi passwords can expose networks.
It allows easy, unauthorized network access.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can gain access to a targeted device's Wi-Fi network by observing its network name (SSID). The device's default Wi-Fi password is created using a predictable formula based on the SSID. This allows an unauthenticated attacker to calculate the password and connect to the network, potentially leading to unauthorized access to sensitive information or further network compromise.

Attacker observes the Wi-Fi network name.
Predicts the default Wi-Fi password.
Unauthorized network access and data theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows an attacker who can observe the device's Wi-Fi network name (SSID) to predict the factory default Wi-Fi password. This could enable unauthorized access to the local network if the default password has not been changed.

Default Wi-Fi credentials.
Predictable password from SSID.
Unauthorized local network access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts FiberHome HG6145F1 devices, commonly found at the network edge for internet connectivity. Responsibility likely falls to network or infrastructure teams managing these customer-premise devices, in coordination with vendor management if applicable. The initial step is to identify all deployed HG6145F1 units, assess their exposure and criticality, and then plan remediation.

Network and infrastructure teams should own this.
Verify exposed devices and their SSIDs.
Plan targeted configuration changes or replacements.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FiberHome HG6145F1?

The FiberHome HG6145F1 is a GPON ONU, which acts as a modem and router for fiber-optic internet connectivity. These devices are typically installed at residential or small office premises to provide gateway services, managing local network traffic and broadcasting Wi-Fi signals for wireless devices.

What does CWE-284 mean for CVE-2025-63353?

This vulnerability is classified under CWE-284, which refers to Improper Access Control. In this specific case, the device uses a predictable algorithm to generate factory default Wi-Fi passwords based on the SSID. Because the password logic is not sufficiently random, the system fails to restrict access effectively, allowing unauthorized parties to authenticate using a calculated key.

How can an attacker trigger this vulnerability?

An attacker triggers this by observing the device's broadcasted Wi-Fi name (SSID). Because the password generation formula is deterministic, the attacker can derive the default passphrase without needing prior access or interaction with the router. Note that this flaw only impacts devices still using their original factory-set credentials; it does not apply if a user has manually changed the default Wi-Fi password.

Who should be concerned about this vulnerability?

Anyone managing these routers should be concerned. According to Halo Surface Signal, these devices are deployed at the network edge, making them highly visible and discoverable within the local radio environment. Because they broadcast their SSID, they are essentially external-facing, meaning unauthorized individuals in proximity to the physical device could potentially gain network access.

How do I secure my device against this threat?

If you are running an HG6145F1, your first priority is to change the default Wi-Fi password immediately. Replacing the factory-set credential with a strong, unique, and manually configured passphrase invalidates the predictable algorithm used by the device. After updating your credentials, ensure that firmware is updated if the vendor provides a patch to address the underlying generation mechanism.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.