FiberHome HG6145F1 Predictable Default Wi-Fi PSK Derived from Broadcast SSID (CVE-2025-63353)

Metadata

Affected Target

Summary

The FiberHome HG6145F1 GPON ONT broadcasts a factory-default SSID of the form fh_<hex_a>, where <hex_a> is a six-character lowercase hex string. The factory-default WPA2 pre-shared key printed on the device label is a deterministic function of that same value: PSK = "wlan" + hex(0xFFFFFF XOR hex_a). Because the SSID is broadcast in cleartext in every beacon frame, any passive observer within Wi-Fi range can compute the default PSK in microseconds with a single XOR/complement operation — no captured 4-way handshake, no wordlist, no GPU cracking, and no client interaction are required. The per-device effective keyspace, given the observed SSID, is exactly one.

Vulnerability Details

Root Cause

The device’s factory Wi-Fi credential provisioning routine derives the WPA2-PSK directly from the broadcast SSID via a fixed, reversible transform (nibble-wise complement against 0xFFFFFF) instead of generating it from a hardware random number generator at manufacture time. Because the transform is symmetric and public once known, and the SSID input is transmitted unencrypted in every beacon frame, the PSK carries zero bits of entropy conditioned on the SSID.

Attack Vector

1. Passive observation: Scan for a beacon frame whose SSID matches the pattern fh_[0-9a-f]{6} — any standard Wi-Fi adapter or even a smartphone Wi-Fi scan is sufficient.
2. PSK derivation: Compute "wlan" + lowercase_hex(0xFFFFFF XOR hex_a, 6 digits) from the six hex characters following fh_ in the SSID. For example, SSID fh_a1f9d1 yields PSK wlan5e062e (verify via nibble complement: F-a=5, F-1=e, F-f=0, F-9=6, F-d=2, F-1=e → 5e062e).
3. Association: Connect to the network with the derived PSK using any standard WPA2 supplicant (wpa_supplicant, iwd, OS network manager).

No step requires elevated privileges, monitor mode, packet injection, or prior knowledge of the target beyond what the device itself broadcasts.

Impact

Full compromise of the Wi-Fi network’s confidentiality and integrity guarantees: an attacker within radio range can join the private LAN as a trusted client, intercept/manipulate traffic of other connected devices, and pivot to any exposed home/office network services — all from a purely passive reconnaissance step (observing the SSID) followed by a standard, authorized-looking association.

Environment / Lab Setup

Target:   FiberHome HG6145F1 ONT, firmware RP4423, factory-default Wi-Fi configuration
                (SSID of the form fh_<6-hex-chars>, unmodified default PSK)
Attacker: Any device with a standard 802.11 Wi-Fi radio within beacon range;
                Python 3.10+ / Go / Node.js / a C compiler to run the PoC derivation script

Proof of Concept

PoC Script

See poc/python/fh-poc.py (also poc/go/fh-poc.go, poc/javascript/fh-poc.js, poc/c/fh-poc.c — four independent, dependency-free implementations producing identical output).

1
2
3
4

python3 poc/python/fh-poc.py fh_a1f9d1
cd poc/go && go run fh-poc.go fh_a1f9d1
node poc/javascript/fh-poc.js fh_a1f9d1
cc poc/c/fh-poc.c -o fh-poc && ./fh-poc fh_a1f9d1

Each script validates the SSID against the fh_[0-9a-f]{6} pattern, XORs the six-hex-digit suffix against 0xFFFFFF, and prints the resulting wlan<hex> string — the exact factory-default WPA2 PSK for the observed SSID.

Detection & Indicators of Compromise

Signs of compromise:

• Unrecognized clients associated with an HG6145F1 network still using its factory-default SSID/PSK pairing
• ISP inventory or ACS (TR-069) records showing HG6145F1 RP4423 units that have never received a PSK-change event since activation

Remediation

References

• Source repository
• Original disclosure — Hani Anis Bouzid (Medium)
• Original PoC — hanianis/CVE-2025-63353
• NVD entry
• GitHub Advisory GHSA-cg2x-c25f-6327

Notes

Mirrored from https://github.com/Zvckster/CVE-2025-63353 on 2026-07-06. This repository is a multi-language PoC extension (Python/Go/JavaScript/C implementations plus a curated documentation set) built on the original vulnerability discovery and disclosure credited to Hani Anis Bouzid. No vendor advisory or firmware patch has been published as of the most recent update to the upstream repository’s disclosure timeline.