Vulnerability in Fibar Group S.a Fibaro Home Center
CVE-2021-20989
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.020 (79.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 79.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: 0.000
Affected products
- Fibar Group S.a Fibaro Home Center — versions Home Center 2, Home Center Lite
- Fibaro Home Center 2
- Fibaro Home Center 2 Firmware
- Fibaro Home Center Lite
- Fibaro Home Center Lite Firmware
Weakness classification (CWE)
References
- www.iot-inspector.com/blog/advisory-fibaro-home-center/ (Exploit, Third Party Advisory)
- seclists.org/fulldisclosure/2021/Apr/27 (mailing-list, Mailing List, Third Party Advisory)
- packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentica… (Exploit, VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-20989?
- CVE-2021-20989 is a medium-severity vulnerability in Fibar Group S.a Fibaro Home Center, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2021-04-19.
- How severe is CVE-2021-20989?
- Medium severity. CVSS v3 base score is 5.9 out of 10.