PT-2021-10713 · Unknown · Homeautomation

Gjoko Krstic · Published 2021-04-27 · Updated 2025-10-08 · CVE-2020-21998

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HomeAutomation version 3.3.2

Description The issue arises from improper verification of input passed via the redirect GET parameter in the "api.php" script. This can be exploited to redirect a user to an arbitrary website, for example, when a user clicks a specially crafted link to the affected script hosted on a trusted domain.

Recommendations For HomeAutomation version 3.3.2, as a temporary workaround, consider restricting access to the "api.php" script or disabling the use of the redirect parameter until a proper fix is available. Avoid using the redirect parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-21998

Affected Products

Homeautomation

References · 5

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5559.php · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2019120132 · Exploit
• https://osv.dev/vulnerability/CVE-2020-21998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21998 · Security Note
• https://twitter.com/pdnuclei_bot/status/1975909079139619056 · Twitter Post