CVE-2021-4464 FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow
Remote attackers can trigger a stack buffer overflow in FiberHome routers via oversized HTTP cookies, potentially executing arbitrary code or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4464?
CVE-2021-4464 is a critical memory corruption vulnerability in FiberHome AN5506-04-FA, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun, leading to a crash or potential control of execution flow.
Weakness: CWE-121
Which versions are affected by CVE-2021-4464?
How do I fix CVE-2021-4464?
No fix has been published for CVE-2021-4464 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-4464 being exploited?
There is no known exploitation of CVE-2021-4464 in the wild and no public exploit code.
Sources
Also known as GHSA-9m65-3xwh-873p.