PT-2026-1440 · Fibaro · Fibaro System Home Center

Published 2026-01-06 · Updated 2026-01-06 · CVE-2020-36905

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FIBARO System Home Center version 5.021

Description The FIBARO System Home Center contains a remote file inclusion issue in the undocumented proxy API. This allows attackers to include arbitrary client-side scripts. Exploitation occurs through the url GET parameter, enabling the injection of malicious JavaScript. Successful exploitation could lead to user session hijacking or manipulation of page content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2020-36905

Affected Products

Fibaro System Home Center

References · 9

• 🔥 https://packetstorm.news/files/id/156869 · Exploit
• 🔥 https://exploit-db.com/exploits/48240 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2020030140 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36905 · Security Note
• https://vulncheck.com/advisories/fibaro-system-home-center-remote-file-inclusion-via-proxy-api · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5563.php · Note
• https://t.me/cveNotify/147858 · Telegram Post
• https://fibaro.com · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/178269 · Note