I wanted to turn the HG6145F1 password generator vuln into a small desktop app I could run locally and easily. I already had the router login page, a logged-in device-information page, a code view, and the GUI output, so I traced the path from the MAC input to the generated string and rebuilt that flow in C++/Qt.

There is one naming detail I had to keep straight while writing this: the MAC-based admin-password generator in this post is not the Wi-Fi flaw described by CVE-2025-63353. The CVE record describes a factory Wi-Fi key that can be predicted from the broadcast SSID on HG6145F1 RP4423. My app takes a MAC address and generates an admin-password candidate. Same router family, different credential and different input. CVE record

Scope and what the screenshots show

The target shown in my device page is a FiberHome HG6145F1 running RP4423. The first screenshot is the router’s web login screen for super user: admin is the username and the password is [Something that non of ur business]. The next page is the device-information screen after login; it shows the model and firmware. PoC for the concept script.

Those pages establish the interface and the model/firmware visible in my screenshots. Successfully pwning the router Panel with 0 interaction.

Part 1: Following the MAC input

The code starts in generatePassword(QString mac). Before the calculation, the GUI checks that the input has six hexadecimal pairs separated by colons. The function then uppercases the MAC and appends the fixed text AEJLY:

entered MAC
    ↓ uppercase
uppercase MAC + "AEJLY"

That combined string is the seed. The program hashes it with MD5 and converts the digest to hexadecimal text. It reads the first 20 hex characters as 20 values from 0 to 15. This is deterministic: the same MAC always gives the same digest and the same values.

Part 2: Turning digest values into a password

The generator uses four character groups: uppercase letters, lowercase letters, digits, and symbols. For the first 16 digest values, each value selects a group and an index inside that group. This creates the initial 16-character string.

The final four digest values are used a second time. Each one picks a position in the 16-character string, and the code resolves collisions if two values pick the same position. It then writes one character from each of the four groups into those positions. That last pass makes sure the result contains at least one uppercase letter, one lowercase letter, one digit, and one symbol.

The important part is that nothing is fetched from the router while this calculation runs. The MAC is the only input; the suffix, digest, character choices, and position replacements all happen locally. This is why the app works offline, and also why the output is repeatable rather than a newly randomized password each time.

Part 3: Putting the calculation in the GUI

I kept the calculation in one function and connected it to a small Qt interface. The app validates the MAC format, runs the function, displays the result, and lets me copy or clear it. I tested the built app locally: entering a valid MAC produced a 16-character result in the output panel.

I Intended to input a MAC Address into my software to test and it gave me the exact working password for the panel under that MAC Address. meaning the logic worked.

Where CVE-2025-63353 fits

CVE-2025-63353 is a separate default-credential issue. Its documented path starts with the SSID and concerns the factory Wi-Fi pre-shared key. The code and GUI in this post start with a MAC address and generate an administrator password. They should not be presented as the same method, and this GUI is not a proof-of-concept for the CVE.

The shared security lesson is narrower: a default credential should not be reproducible from information that is observable or printed on the device. For the CVE-affected Wi-Fi configuration, replace the factory Wi-Fi passphrase with a unique random one. Change the router’s administrator password separately, and check with the ISP or vendor for firmware guidance for the exact revision.

My work

There is no link between the CVE and This Research Beside giving me an idea/starting point to dig into. and ended up working so far its been tested on multiple routers with default passwords and was able to get all of their passwords just from MAC address.

Download Linux Executable Download Windows Executable Virustotal Scan

PGP signature.

—–BEGIN PGP PUBLIC KEY BLOCK—–

Comment: CBA7A8D17567739EDDCADC189FD988AD5706197A

mDMEakvBWhYJKwYBBAHaRw8BAQdAo/xqic5vYsJrXeMcmqtQ8F6c7GUbEHLEZaoh Ir9NvxK0H2FtZGVsdWx1IDxtYXliZXBhbmljQGdtYWlsLmNvbT6IrwQTFgoAVxYh BMunqNF1Z3Oe3crcGJ/ZiK1XBhl6BQJqS8FaGxSAAAAAAAQADm1hbnUyLDIuNSsx LjEyLDIsMQIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRCf2YitVwYZ ekY5AP9a7MkAyNXR8LtTIbB/8hGKjOVzkQNVB8MMc1JBqtJ6xgEAuh2a34IzL3FI 22BSUoIzd4OMBpiqPx4ic1p9CSPqnAC4OARqS8FaEgorBgEEAZdVAQUBAQdAyHZ9 /IqmYyhjOIt1/beu83cbG25d9EnMkMcOl492vCcDAQgHiJQEGBYKADwWIQTLp6jR dWdznt3K3Bif2YitVwYZegUCakvBWhsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwy LDECGwwACgkQn9mIrVcGGXoToAEAlboJyWlXPV56oTLfP5KCS7IaXVTOPp7XLLz2 w0bRWzwA/1CPp3tM1swtDVitApxsrvHk16HWxNhPLho2PB1N2loP =4JMD

—–END PGP PUBLIC KEY BLOCK—–