Read the docs
TI-2021-03320 Aliases CVE-2021-4464GHSA-9m65-3xwh-873p

FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow

Priority MEDIUM 52CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun, leading to a crash or potential control of execution flow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02177 82nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix Fixed HG6245D (FiberHome): RP2602

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FiberHomeAN5506-04-FAup to RP2631—No fix listedCNA
FiberHomeHG6245Dbefore RP2602RP2602Patch availableCNA
  • AN5506-04-FA VendorFiberHome Affected up to RP2631 Fixed in — No fix listed CNA
  • HG6245D VendorFiberHome Affected before RP2602 Fixed in RP2602 Patch available CNA

Remediation

  • Fix · CNA HG6245D (FiberHome) Fixed in RP2602

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4464
  2. 2026-10-03 Alias added: GHSA-9m65-3xwh-873p

References

Exploit 2

  • TI-2017-10307 An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25… CVSS 3.0CRITICAL 9.8
  • TI-2017-12432 The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based… CVSS 3.0CRITICAL 9.8
  • TI-2017-12430 Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices… CVSS 3.0CRITICAL 9.8
  • TI-2021-08709 An issue was discovered on FiberHome HG6245D devices through RP2613. CVSS 3.1CRITICAL 9.8
  • TI-2021-08711 An issue was discovered on FiberHome HG6245D devices through RP2613. CVSS 3.1CRITICAL 9.8
  • TI-2021-08705 An issue was discovered on FiberHome HG6245D devices through RP2613. CVSS 3.1CRITICAL 9.8
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences