Vulnerability · Published Apr 19, 2021 · Assigned by CERTVDE
CVE-2021-20990Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery mode
High 7.5
In plain English
A high-severity missing authentication in Fibaro Home Center from Fibar Group S.A. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.4%top 11.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fibar Group S.A | Fibaro Home Center | Home Center 2 – through 4.600Home Center Lite – through 4.600 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ x_refsource_CONFIRM
- 20210419 [CVE-2021-20989, CVE-2021-20990, CVE-2021-20991, CVE-2021-20992] Multiple vulnerabilities in Fibaro Home Center mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html x_refsource_MISC