CVE-2017-14147: FiberHome AN1020-25 router unauthenticated factory reset

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is trivially exploitable over the network with no authentication, has public exploit code and very high EPSS, but it is not in KEV and affects a specific legacy router model.

What it is

The FiberHome AN1020-25 ADSL router exposes a restoreinfo.cgi page that performs a factory reset without any authentication. Anyone who can reach the router's web interface can wipe its configuration and force it back to default settings. Because the device then uses default credentials, the attacker can log in and take control of the router.

Impact

An attacker gains full administrative control of the router after resetting it and logging in with default credentials, enabling configuration changes, traffic interception or redirection, and use of the device as a pivot into the local network.

Attack surface

Reachable over the network via HTTP by browsing to http://[Default-Router-IP]/restoreinfo.cgi; no authentication and no user interaction are required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Exposure is limited to routers whose web management interface is reachable by the attacker.

Exploitation

Public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit), and EPSS is 0.65621 (99.2nd percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the vendor firmware fix for the AN1020-25 if FiberHome has released one; the record does not name a fixed version, so confirm with the vendor.
• If no fix is available, disable or block remote access to the router's web management interface and restrict it to trusted LAN hosts only.
• Change default administrative credentials and disable remote WAN-side management.
• Segment or replace end-of-life routers that cannot be patched, and monitor them for unexpected configuration resets.

Detection

• Monitor router logs and configuration state for unexpected factory resets or reboots.
• Detect HTTP requests to /restoreinfo.cgi in web or proxy logs, especially from outside the trusted management network.
• Alert on logins using default router credentials or on management logins from unusual source addresses.
• Scan the network for FiberHome AN1020-25 devices with reachable web management interfaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.