Cloudanix VulnDB

CVE-2017-14147

Critical · 9.8

CVSS

9.8

EPSS

65.6%

Published

Sep 7, 2017

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Attend

Anyone on the internet can reset certain old FiberHome routers to factory settings without a password, letting them take over the device using the original default login.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Full Compromise
Component
Firmware
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
High

What it actually does

Unauthenticated remote access to restoreinfo.cgi endpoint bypasses all authentication and triggers factory reset of the device, restoring default credentials and configuration.

Why it matters to the business

Attackers can remotely disable customer internet connectivity and regain administrative control using well-known default credentials, causing widespread service outages and exposing networks to further compromise.

How an attack unfolds

An attacker sends an unauthenticated HTTP GET request to the restoreinfo.cgi endpoint on the router; the device accepts the request without verification, resets itself to factory defaults, and the attacker then authenticates with the published default username and password to obtain full control.

How to fix it

Replace the affected AN1020-25 devices with supported hardware; if immediate replacement is impossible, restrict WAN access to the management interface via firewall rules and change all default credentials after any manual reset.

How to confirm the fix worked

Attempt to reach /restoreinfo.cgi from an external host and verify the request is rejected or returns an authentication challenge; confirm no unauthenticated reset occurs and that default credentials have been changed.

Typical attack path

  1. Discover exposed FiberHome AN1020-25 router via internet scanning
  2. Issue HTTP GET to http://[router-ip]/restoreinfo.cgi
  3. Confirm device has reset by loss of connectivity or login prompt change
  4. Authenticate using default credentials to obtain administrative access

How to detect it

Inspect web server or router access logs for GET requests to restoreinfo.cgi or similar restore endpoints; correlate with sudden loss of custom configuration or login attempts using default credentials.

  • GET /restoreinfo.cgi
  • restoreinfo.cgi
  • FiberHome AN1020-25 default credentials login after unexpected reset

What your security team should do

  • Block all inbound access to TCP/80 and TCP/443 from untrusted networks for these devices
  • Scan networks for AN1020-25 devices and schedule replacement
  • Monitor logs for any requests containing restoreinfo.cgi

The record

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://[Default-Router-IP]/restoreinfo.cgi & execute it. Due to improper authentication on this page, the software accepts the request hence allowing attacker to reset the router to its default configurations which later could allow attacker to login to router by using default username/password.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities