Full Compromise of the FiberHome HG6145F1 GPON Router: A Case Study in ISP-Scale Firmware Vulnerabilities

Gigabit-capable Passive Optical Network (GPON) routers are deployed at national scale by Internet Service Providers (ISPs), frequently using a single firmware image across millions of subscriber devices. A single implementation flaw can therefore affect an entire national subscriber base simultaneously. In this paper, we present a security analysis of the FiberHome HG6145F1 GPON router (firmware revision RP4423), deployed by a major Algerian ISP as part of a national FTTH rollout. Through static reverse engineering of the device's CGI binary and shared libraries using IDA Pro, combined with dynamic testing on physical hardware that we own, we identified fourteen CVE-class vulnerabilities spanning authentication design, cryptographic key management, input validation, and system architecture. Nine of these vulnerabilities have been assigned CVE identifiers by MITRE (CVE-2026-37752 through CVE-2026-37760); five remain pending at the time of writing. Chained together, these vulnerabilities allow an attacker who knows only the router's MAC address to obtain a persistent root shell on the device in under five minutes, without any prior credentials. We describe our methodology, present a root-cause analysis for each vulnerability class, document the end-to-end attack chain, and report a disclosure process during which neither the vendor nor the ISP responded within the initial three-month window. We conclude with concrete mitigations for the vendor, for ISPs deploying this hardware, and for end users.