Vulnerability in Fibar Group S.a Fibaro Home Center
CVE-2021-20989
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.
Vulnerability class: Improper Certificate Validation
EPSS: 0.020 (78.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Fibar Group S.a Fibaro Home Center — versions Home Center 2, Home Center Lite
- Fibaro Home_center_2
- Fibaro Home_center_2_firmware
- Fibaro Home_center_lite
- Fibaro Home_center_lite_firmware
Weakness classification (CWE)
References
- info@cert.vde.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- info@cert.vde.com (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- info@cert.vde.com (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-20989?
- CVE-2021-20989 is a medium-severity vulnerability in Fibar Group S.a Fibaro Home Center, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2021-04-19.
- How severe is CVE-2021-20989?
- Medium severity. CVSS v3 base score is 5.9 out of 10.