PT-2021-14319 · Fibaro · Fibaro Home Center 2+1

Marton Illes · Published 2021-04-19 · Updated 2022-10-29 · CVE-2021-20990

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.600 and older

Description: The issue concerns an internal management service accessible on port 8000, where certain API endpoints can be accessed without authentication. This allows unauthorized actions such as triggering a shutdown, a reboot, or a reboot into recovery mode.

Recommendations: For Fibaro Home Center 2 and Lite versions 4.600 and older, update to a version newer than 4.600 to resolve the issue. As a temporary workaround, consider restricting access to port 8000 to minimize the risk of exploitation. Avoid using API endpoints that can trigger shutdown, reboot, or reboot into recovery mode without proper authentication until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-20990

Affected Products

Fibaro Home Center 2

Fibaro Home Center Lite

References · 8

• 🔥 https://iot-inspector.com/blog/advisory-fibaro-home-center · Exploit
• 🔥 http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-20990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20990 · Security Note
• http://seclists.org/fulldisclosure/2021/Apr/27 · Note
• https://t.me/cybersecuritytechnologies/3192 · Telegram Post
• https://t.me/cvenotify/13448 · Telegram Post
• https://t.me/defcon_news/74074 · Telegram Post